CISM Question 150

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  D. Linking security metrics to business objectives The MOST important consideration when reporting the effectiveness of an information security program to key business stakeholders is to link security metrics to business objectives. This approach ensures that security efforts are aligned with the overarching goals and priorities of the organization.

• 1

  D. Linking security metrics to business objectives

• Chose D4

  D. Linking security metrics to business objectives When reporting the effectiveness of an information security program to key business stakeholders, the most important consideration is linking security metrics to the business objectives. This helps to demonstrate the value of the information security program by showing how it supports the overall goals and objectives of the organization. By linking security metrics to business objectives, it becomes clear how the program is helping to protect the organization's assets and reduce risk, which is the ultimate goal of an information security program. Linking security metrics to the business impact analysis (BIA) and demonstrating a decrease in information security incidents and cost savings are also important considerations, but they are not as important as linking security metrics to business objectives as they don't provide a clear indication of how the program is aligning with the organization's goals and objectives.