Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
This is the most effective approach because it directly ties the implementation of security controls to the organization's established security policy. By assessing the process against the defined security policy, the organization ensures that the controls are aligned with its security requirements, regulatory obligations, and overall security objectives.
Assessing the process against the organization's information security policy ensures that security controls are aligned with the organization's specific requirements and standards.
Assessing the process against the organization's information security policy ensures that security controls are aligned with the organization's specific requirements and standards. It provides a direct evaluation of whether the implemented controls meet the organization's expectations for safeguarding information. While using a recognized control framework (Option A) and reviewing the process for conformance with information security best practices (Option B) are important, directly assessing the process against the organization's information security policy is a more specific and targeted approach. Benchmarking the process against industry practices (Option C) may provide valuable insights, but it does not necessarily ensure alignment with the organization's specific security policy and requirements.