CISM Question 122

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  its new policy so it should be communicated right, if its prohibitive it should be identified during development of policy

• Chose D1

  D. The corresponding controls are viewed as prohibitive to business operations. When an organization's new information security policy is not being followed across all departments, the greatest concern for an information security manager should be that the controls outlined in the policy are viewed as prohibitive to business operations. This indicates a significant disconnect between the security measures and practical business functions, suggesting that the security controls may be overly restrictive, poorly designed, or not well integrated with current business processes. This is a critical concern because if security controls hinder business operations, it leads to a higher likelihood of non-compliance as departments might bypass or ignore these controls to meet business objectives. Such behavior can expose the organization to risks and vulnerabilities that the policy intends to mitigate.

• Chose D3

  Remember that when creating this policy in the first place the ISM should put alignment with business needs at the top of their agenda. For him to be told that it isn't aligning or supporting the needs of the business would be of great concern.