CISM Question 89

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  While calculating precise ROI can be challenging for certain security initiatives, estimating the reduction in risk provides a qualitative measure of the initiative's potential impact. Highlighting the expected decrease in the likelihood and impact of security incidents, as well as the potential harm to the organization, can help justify the investment in information security. Options A, B, and C are valuable considerations in a business case, but they may not capture the essence of the security initiative's impact as effectively as emphasizing the anticipated reduction in risk.

• 1

  D. Estimated reduction in risk

• 2

  Business case is the key word here. Business case should contain risk tagged with the Business so that senior management makes appropriate decisions based on that.