Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
I would also say it's A. Since risk exposure is a measure of possible future loss which may result from an activity or occurrence. In business, risk exposure is often used to rank the probability of different types of losses and to determine which losses are acceptable or unacceptable. So if infosec program manages to reduce to losses, it directly provided value to the business.
A. Measuring the reduction in risk exposure considers the holistic impact of security efforts, including vulnerability management, threat detection and response, and risk mitigation strategies. It aligns with the primary goal of information security, which is to manage and reduce risk to an acceptable level. Therefore, it is considered the most comprehensive and meaningful measure of the effectiveness of an information security program.
A. Reduction in the amount of risk exposure in an organization