CISM Question 106

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  In information security governance, recurring costs (like annual maintenance fees) must be justified by showing continuous operational effectiveness and risk reduction. Establishing and presenting metrics—such as the volume of blocked attacks, threat mitigation trends, and incident prevention rates—provides management with concrete, data-driven proof that the IPS is actively protecting the organization.

• Chose C1

  Given he needs to justify the cost, C speaks to a cost to benefit

• Chose C1

  periodic testing of effectiveness