CISM Question 109

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  I believe it’s policy. In the policy it should state that standards should be developed to achieve consistency in configurations. If that is not in the policy, then the standard may not even exist.

• Chose D2

  This is one of the main differences between a policy and standard: Policies act as a statement of intent, while standards function as rules to achieve that intent.

• 1

  D. standards provide the specific instructions needed to ensure that user account setups are performed uniformly, making them the most important aspect to review in this situation. Once standards are established and enforced, policies, automated controls, and guidelines can complement them in maintaining a robust security posture.