CISM Information Security Program Practice Question
After a data breach, the CISO reviews the security program. The breach exploited a known vulnerability in a legacy system that was deemed 'acceptable risk' two years ago. What should the CISO do to improve the program?
⚠ Common exam trap
Many candidates confuse risk acceptance with a permanent decision, failing to recognize that accepted risks must be periodically re-evaluated as part of a continuous risk management process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a process for periodic reassessment of accepted risks.
Risk acceptance is not a one-time decision; it must be periodically reassessed to account for changes in the threat landscape, business context, or compensating controls. The breach exploited a known vulnerability that was accepted two years ago, indicating the risk environment has shifted (e.g., new exploit code, increased attacker interest). Implementing a periodic reassessment process ensures that accepted risks are re-evaluated against current threats and vulnerabilities, allowing the organization to either renew acceptance, apply mitigations, or retire the system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Establish a policy that legacy systems must be upgraded annually.
Why it's wrong here
A blanket annual upgrade policy ignores risk-based treatment and may be unachievable for systems that cannot be patched, leaving the same accepted-risk gap. It is tempting because it appears decisive, and would be correct for systems where a fixed patch cadence is genuinely feasible.
- ✗
Disconnect the legacy system from the network immediately.
Why it's wrong here
Disconnecting the legacy system is a tactical containment action, not a program improvement; it also ignores the governance failure that let a known vulnerability remain accepted without review. Risk acceptance is legitimate when periodically reassessed and time-bound, so the correct answer addresses that process rather than the asset itself.
- ✓
Implement a process for periodic reassessment of accepted risks.
Why this is correct
The breach occurred because an accepted risk was never revisited as the threat landscape and asset criticality changed. Periodic reassessment ensures accepted risks remain valid, triggering re-evaluation or treatment when conditions shift, directly closing the governance gap that allowed the legacy vulnerability to persist.
- ✗
Require immediate remediation of all legacy systems.
Why it's wrong here
Blanket remediation of every legacy system treats risk acceptance as inherently invalid and ignores compensating controls, business criticality and cost. Risk acceptance is a valid treatment when documented, time-bound and periodically reviewed; the program failure here was the absence of that review, not the decision to accept risk.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.