CISM Question 68

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D3

  When establishing metrics for an information security program, it is important to focus on indicators that demonstrate the effectiveness of the security program. These metrics should provide insights into the program's performance, its ability to mitigate risks, and its overall impact on the organization's security posture. Metrics that demonstrate effectiveness help in assessing the success of security initiatives and provide valuable information for decision-making and continuous improvement.

• Chose D2

  Metrics in an information security program should focus on demonstrating the effectiveness of the security measures and their contribution to the overall security posture. Effectiveness metrics help assess how well security controls are working, the level of risk reduction achieved, and the program's ability to meet its objectives. These metrics provide valuable insights for decision-makers and help in continuous improvement efforts. While supporting major information security initiatives (option A) is important, the primary goal is to measure effectiveness. Reflecting the corporate risk culture (option B) is important but might not directly measure program effectiveness. Metrics that reduce information security program spending (option C) may not necessarily align with the goal of demonstrating effectiveness and may not provide a comprehensive view of the security program's success.

• 1

  D. demonstrate the effectiveness of the security program.