Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
It is proactive and directly enforces compliance. When controls are built into the process, compliance happens by design rather than relying on separate risk assessments or manual checks.
While all of the options contribute to ensuring compliance with information security policies, the most effective approach is: A. Ensuring that key controls are embedded in the processes By embedding key controls directly into IT processes, organizations can: Automate compliance: Many controls can be automated, reducing the risk of human error. Proactive enforcement: Controls can be designed to prevent non-compliant actions, rather than just detecting them after the fact. Continuous monitoring: Embedded controls can be monitored continuously to identify and address potential issues early on. While training, resource allocation, and risk management are important, they are more focused on preventing and mitigating risks rather than enforcing compliance directly. Embedding controls within the processes themselves provides a more proactive and effective approach to ensuring compliance.
Both A and D make sense. However, it asks for the most EFFECTIVE approach, which to me means more concrete measures. If you integrate controls in the process, you basically achieved assurance that it will all be done in compliance. D also sounds good, but it's more broad and too vague.