CISM Question 320

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  B, the business impact

• 1

  B. The extent that compromise can affect revenue. Classifying application systems is often based on the potential impact of a security breach or compromise. Assessing how a compromise could affect revenue, reputation, data integrity, and other critical business factors helps organizations prioritize their security efforts and allocate resources accordingly. While the other factors mentioned (cost of repairing damage, cost to implement regulatory requirements, and controlling access based on the need to know) are important considerations in information security, they are usually secondary to the primary goal of protecting the organization's revenue and core business functions.

• 2

  According to the CISM Review Manual, 15th Edition: "Information security policies must address asset classification and handling, including the definition and relative hierarchy of classifications... Organizations should also implement procedures to address authorization based on a need-to-know/need-to-use basis, especially for highly sensitive data."