CISM Information Security Program Practice Question
After a data breach, the CISO reviews the security program. The breach exploited a known vulnerability in a legacy system that was deemed 'acceptable risk' two years ago. What should the CISO do to improve the program?
⚠ Common exam trap
Many candidates confuse risk acceptance with a permanent decision, failing to recognize that accepted risks must be periodically re-evaluated as part of a continuous risk management process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a process for periodic reassessment of accepted risks.
Risk acceptance is not a one-time decision; it must be periodically reassessed to account for changes in the threat landscape, business context, or compensating controls. The breach exploited a known vulnerability that was accepted two years ago, indicating the risk environment has shifted (e.g., new exploit code, increased attacker interest). Implementing a periodic reassessment process ensures that accepted risks are re-evaluated against current threats and vulnerabilities, allowing the organization to either renew acceptance, apply mitigations, or retire the system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Establish a policy that legacy systems must be upgraded annually.
Why it's wrong here
Too rigid; does not consider residual risk or compensating controls.
- ✗
Disconnect the legacy system from the network immediately.
Why it's wrong here
Drastic without business impact analysis; may not be necessary if compensating controls exist.
- ✓
Implement a process for periodic reassessment of accepted risks.
Why this is correct
Ensures that risk acceptance stays current with evolving threats and business context.
- ✗
Require immediate remediation of all legacy systems.
Why it's wrong here
May not be feasible or prioritized; risk treatment should be risk-based.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.