CISM Question 54

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose C1

  When the primary message is risk managed at the desired level, the conversation stays strategic. Everything else becomes evidence that either supports or challenges that conclusion.

• Chose C2

  Demonstrating that risk is managed at the desired level is a key aspect of informing senior management about the effectiveness and success of the information security program. This involves providing an overview of risk assessments, mitigation efforts, and the overall state of the organization's risk posture. It enables senior management to make informed decisions about the allocation of resources and the ongoing effectiveness of the information security program in addressing organizational risks. While confirming compliance with security policies (option A), verifying security costs do not exceed the budget (option B), and providing evidence that resources are performing as expected (option D) are important considerations, the primary goal is to ensure that the organization's risk is managed effectively in alignment with its risk tolerance and business objectives.

• 1

  C. Demonstrating risk is managed at the desired level