CISM Question 79

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  C. Business expertise

• Chose A1

  Without individuals with strong information security expertise on the committee, it may struggle to make informed decisions and effectively protect the organization's sensitive information and systems.

• Chose C1

  While information security expertise (Option A) is valuable, having members with business expertise is crucial for the success of an information security steering committee. Information security is not just a technical concern; it is also a business risk that needs to be aligned with overall organizational goals and strategies. Committee members with a strong understanding of the organization's business operations, priorities, and objectives can better integrate information security into the broader business context. Tenure in the organization (Option B) may bring institutional knowledge but does not necessarily guarantee the necessary expertise or alignment with business goals. Cross-functional composition (Option D) is important as it ensures diverse perspectives, but business expertise is still a critical factor for effective decision-making related to information security within the organization.