Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Every other question similar to this answers with culture. Risk management should be the basis, yes. But culture impacts the effectiveness far more.
The phrase "Culture eats Strategy for breakfast" (attributed to Peter Drucker) is not an official ISACA slogan, but it perfectly encapsulates the CISM exam logic: A perfect strategy in a toxic culture will fail, but an imperfect strategy in a strong security culture can still succeed.
I said C but it would be "A" when i think about it since "C" would be part of "A". Organization culture will include Governance.