CISM Question 53

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  Being involved in the change management process allows the information security manager to assess the potential risks associated with proposed changes to the organization's technology, processes, or systems. By evaluating risks, the information security manager can provide input to ensure that security considerations are addressed during the planning and implementation of changes. While options like ensuring that security controls drive technology changes (option A), updating security controls regularly (option C), and identifying potential vulnerabilities (option D) are also important, evaluating risks is a central aspect of ensuring that changes are made in a way that does not compromise the organization's information security posture.

• 1

  B. While the other options (A, C, and D) are also important aspects of change management and information security, evaluating risks is the primary concern because it directly impacts the organization's security posture. Without a thorough evaluation of risks, security controls may not be effective in addressing new threats introduced by changes in technology or processes.

• 1

  Changes cause risk whch should be evaluated