CISM Question 192

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B2

  If you don't have stakeholder input (business unit leaders, end users) how do you know the value to the assets when conducting risk assessments?

• Chose D2

  I'm going with D on this one. Periodic risk assessments help identify vulnerabilities that may threaten regular operations and, consequently, an organization's reputation. By improving the overall cybersecurity defense posture, protecting endpoint devices, and minimizing potential damage from specific threats, risk assessments play a crucial role in shaping and maintaining the resilience of information security programs. While establishing KPIs, obtaining stakeholder input, and understanding current and emerging technologies are essential components of an information security program, conducting periodic risk assessments provides the necessary context and intelligence to inform these activities, making it the cornerstone of a successful information security strategy.

• Chose B5

  B. Obtaining stakeholder input