ISACA Certified Information Security Manager Practice Mode

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  The BEST way for an organization to determine the maturity level of its information security program is to benchmark the information security policy and practices against industry standards using a recognized information security maturity mode

• Chose B2

  The question asks how to determine the maturity of an organization's information security program. A mature security program is not measured by whether policies exist or whether incidents occur. It is measured by how consistently and effectively security controls operate and achieve their intended objectives.

• Chose B4

  According to ChatGPT: Determining the maturity level of an information security program requires assessing how well the program is performing, especially in terms of control effectiveness. ISACA aligns with frameworks like COBIT and CMMI, where maturity is based on how formalized, repeatable, and effective processes and controls are. A. Review the results of information security awareness testing – This only evaluates one component (awareness) and does not reflect overall program maturity. C. Benchmark the information security policy against industry standards – Helpful, but limited to policy comparison, not practice or effectiveness. D. Track the trending of information security incidents – This is reactive and may show risk posture, but not maturity of the program itself. B addresses actual implementation and performance—a core requirement when assessing maturity in line with ISACA's standards.