CISM Question 336

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  C. The organization's vision and mission While audit and regulatory requirements (A), information security policies (B), and the results of a comprehensive gap analysis (D) are important factors to consider in developing an information security strategy, they should all align with and support the organization's overall vision and mission. The organization's vision and mission define its long-term goals, values, and purpose, and the information security strategy should be designed to help achieve and protect these overarching objectives. Therefore, the organization's vision and mission should serve as the foundational basis for developing an effective information security strategy that aligns with the organization's broader strategic goals.

• 1

  the information security manager develops a strategy and requirements based on these objectives. The security manager is required to conduct a gap analysis and identify the strategy to move to the desired state of security from its current state of security. The desired state of security is also termed as the security objectives. This gap analysis becomes the basis for the strategy- Hemang Doshi

• Chose D3

  While C. The organization's vision and mission is a good answer, it is not the best. Gap analysis, includes desired situation, that meets vision and mission, plus current situation, that will allow to draft the path.