Certified Information Security Manager CISM (CISM) — Questions 1–75

Role and job function determine exposure to targeted attacks, such as finance staff facing invoice fraud or executives facing spear phishing. Tailoring simulation difficulty by function ensures relevance and avoids over-testing low-risk roles, satisfying the stem's design factor requirement.

Residual risk above tolerance cannot simply be left; the risk owner must decide. Either obtain formal management approval to accept the elevated exposure or apply further controls to bring it within tolerance, preserving accountability and documented risk ownership.

A retainer pre-negotiates rates, scope and contact details with the forensic firm, so engagement begins immediately when an incident strikes rather than after procurement and contracting delays. This directly reduces the time to engage, preserving volatile evidence.

Without a formal governance framework, the CISO cannot know what controls, gaps or exposures exist. A comprehensive risk assessment of the target's security posture establishes that baseline, informing subsequent governance design, policy alignment and remediation priorities.

A key risk indicator is a forward-looking metric that signals rising risk before it materializes into incidents. It helps the organization anticipate and mitigate threats. Unlike a KPI, which measures performance against objectives, a KRI tracks conditions that could lead to loss, such as increasing vulnerability counts or growing third-party exposure.

Cross-department coordination gaps, not detection, caused containment delays. A coordination plan assigns explicit roles and communication channels across IT, legal and public affairs, while quarterly joint exercises rehearse them. This directly fixes the procedural void at minimal cost, satisfying leadership's quick, low-budget constraint.

Clear ownership and accountability are essential because security obligations span business units, engineering, legal, and operations. Assigning responsibility ensures controls are implemented and maintained rather than assumed, enables escalation, and supports the segregation of duties that auditors and regulators expect from a growing fintech.

Severity classification must reflect the business impact, including regulatory, financial, and reputational consequences. Exposure of payment card data triggers mandatory notification and potential fines under PCI DSS and privacy regulations. CISM emphasizes that incident prioritization is driven by impact to the organization, not by technical metrics alone, making this the primary factor for assigning severity.

Strategic decisions, communications and resource allocation sit with the crisis management team, which handles business-level direction rather than technical containment. This satisfies the stem's P1 constraint: the CMT's mandate is enterprise-wide impact and stakeholder messaging, while the incident response team performs tactical containment and eradication.

Metrics aligned with business objectives ensure that security efforts support organizational goals and are relevant to executive management. They provide meaningful insights into how security contributes to business success, enabling informed decision-making. This alignment is a key characteristic of effective metrics.

Tiering by data type and service criticality reflects actual risk exposure: sensitive data or business-critical services warrant deeper due diligence, contractual controls and monitoring. This risk-based axis directs limited TPRM effort proportionately, rather than treating all vendors identically.

Embedding security clauses directly into RFPs forces vendors to demonstrate compliance before selection, making security a scored procurement criterion rather than an afterthought. This satisfies the requirement to integrate security requirements into the procurement process at the earliest, most influential stage, when contractual leverage is greatest.

A tabletop exercise gathers stakeholders for a facilitated discussion of a hypothetical scenario, walking through plans and procedures without deploying systems or simulating live traffic. This format directly satisfies the stem's requirement for a discussion-based review, distinguishing it from functional or full-scale exercises that test operational response.

Embedding a security champion within each agile team and supplying a lightweight secure coding checklist integrates controls directly into rapid sprints, satisfying the moderate risk appetite and the constraint of avoiding the friction that formal security reviews previously caused.

A playbook supplies prescriptive, step-by-step procedures for a specific incident type such as ransomware, unlike a policy, which states intent, or a plan, which sets broad structure. It satisfies the need for detailed handling instructions.

Layered web application defence combines a WAF filtering malicious HTTP traffic, input validation rejecting malformed data at the application, and security logging enabling detection and forensics. Together these satisfy the stem's defence-in-depth objective across preventive and detective control types at the application layer.

Reporting directly to the CEO or board removes intermediate IT management from the chain, preventing conflicts where the security function audits the same operations it reports through. This satisfies the independence and authority constraint, giving the CISO unfiltered escalation and budget influence.

A risk assessment identifies which assets and processes are most critical to achieving business objectives, and prioritizes threats accordingly. This ensures that security investments are directly tied to protecting what matters most to the business. Without this foundational step, subsequent activities like policy development or control selection lack a business-driven rationale, making alignment difficult to demonstrate to the board.

Shadow cloud purchasing persists because no policy obliges business units to route acquisitions through IT security. A procurement security policy embeds security review into the buying process, closing the governance gap the stem describes; other deficiencies are symptoms rather than the root cause.

Stakeholders need a concise summary of actions taken so far to understand the current response state and what is being done, satisfying the communication-priority constraint. This factual update precedes speculation about cause or impact, keeping messaging accurate and reassuring during the incident.

Security champions are developers who receive security training and act as the first point of contact within their own teams, embedding expertise where code is written. This satisfies the stem's primary benefit by scaling security knowledge without adding dedicated security headcount to every team.

At Level 5 (Optimizing), processes are continuously improved through quantitative measurement and feedback, satisfying the stem's requirement for proactively measured and optimised security. Lower levels merely define, manage or quantitatively control processes without this continuous optimisation focus.

ALE expresses risk in financial terms by multiplying the single loss expectancy by the annualized rate of occurrence, directly linking security spending to expected monetary loss. This allows the CISO to compare initiatives on a consistent financial basis and justify investments to the CFO using the same language as other business cases.

Disabling the compromised account removes the attacker's known access path, and rotating privileged credentials invalidates any other stolen secrets the attacker may hold. This contains the incident without shutting down business operations, which supports the CISM principle of balancing security with business continuity. It also addresses the likelihood that the attacker harvested additional credentials from the compromised administrator's session or memory, closing related entry points.

User resistance to MFA typically stems from unfamiliarity rather than the control itself. Training explains the rationale and correct enrolment, improving compliance without weakening the policy. Removing or exempting MFA would undermine the remote-access protection the organisation mandated.

Board or executive management approval confers enterprise-wide authority and accountability, since only top leadership can mandate compliance across all business units and commit resources. This satisfies the policy's requirement for authority and accountability by placing ownership at the highest governance level.

A pre-established forensic retainer defines scope, rates and contacts in advance, so the firm can be engaged immediately when an incident occurs. This directly satisfies the stem's constraint of reducing engagement delay, avoiding procurement and legal negotiation during the critical containment window when evidence preservation is time-sensitive.

The CEO sits on the crisis management team to authorise strategic decisions, external communications and resource commitments during a major incident. This satisfies the stem's selection of typical CMT roles, distinguishing executive crisis governance from the tactical incident response team handling containment and recovery.

Expressing the investment as reduced risk exposure and avoided breach cost translates security benefit into financial terms, letting the CISO compare spend against expected loss reduction. Qualitative maturity gains alone cannot quantify value for a business case.

Incident response supplies the SOC's reactive capability: triage, containment, eradication and recovery once detection confirms an event. Without it, monitoring generates alerts with no structured path to resolution, so it is a core operational component alongside detection.

When recovery cannot meet the maximum tolerable downtime, the incident ceases to be a technical problem and becomes a continuity problem. Escalating to activate the business continuity/disaster recovery plan invokes pre-authorised alternate processing arrangements, restoring critical services through failover rather than waiting for server restoration.

A board-level risk committee provides the governance structure through which directors exercise oversight of security posture, satisfying the stem's requirement for board-level accountability. Unlike operational controls, this mechanism escalates cyber risk into enterprise risk reporting, ensuring strategic decisions and risk tolerance are reviewed at the highest level.

Holding the lessons learned meeting within two weeks of resolution captures details while memories remain fresh and evidence is accessible, yet allows initial recovery to settle. This timing balances accuracy against operational demands, yielding actionable improvements to the incident response programme.

This suggests data theft or espionage.

5 Whys is an iterative interrogative technique that repeatedly asks 'why' to strip away symptomatic layers and expose the underlying causal factor. Applied after containment, it drills from the immediate ransomware trigger down to the root weakness, satisfying the root cause analysis requirement.

Regular engagement with business unit leaders surfaces their objectives and risk tolerance, letting security strategy be shaped around them. This satisfies the alignment goal directly, since security priorities derive from documented business needs rather than from technical or compliance-driven assumptions.

Integrating security objectives into the business strategy planning process ensures that security is considered from the outset. By participating in business strategy discussions, the CISO can align security initiatives with business goals, identify risks, and ensure that security enables rather than impedes business objectives. This collaborative approach is most effective for alignment.

A P1 ransomware attack encrypting critical systems threatens business continuity and may involve extortion, regulatory notification and executive decisions beyond IT's authority. This severity and cross-functional impact trigger crisis management team involvement, satisfying the stem's requirement for incidents demanding strategic, organisation-wide response rather than routine technical remediation.

CISM defines crisis declaration around significant business impact and the need for strategic coordination across the organization. When an incident threatens critical business functions, reputation, or regulatory obligations, the CMT should be activated to provide executive direction, prioritize resources, and manage stakeholder communications. This factor directly reflects the purpose of the CMT and is the most reliable basis for the decision.

The BIA establishes critical business processes and their maximum tolerable downtime and data loss, expressed as RTOs and RPOs. The next logical step is to ensure the disaster recovery plan for information systems is updated to meet these targets. This directly links security and resilience priorities to business impact, ensuring recovery capabilities are aligned with what the business actually needs.

The board's risk appetite and tolerance levels provide the criteria for evaluating and treating risks. Aligning treatment with appetite requires first understanding what the board deems acceptable. This step ensures that subsequent risk assessments and control decisions are consistent with organizational objectives and regulatory constraints. It is the foundational step before any analysis or control implementation in the new region.

The incident response manager runs the response end to end, tasking technical teams and assigning severity classifications that trigger escalation and notification thresholds. This satisfies the stem's requirement for the coordinating role, distinguishing it from the executive sponsor's governance remit and the communications lead's messaging duties.

A security steering committee with cross-functional representation exists to provide governance: setting strategic direction, aligning security investment with business priorities, and resolving conflicts between security and operational needs. This matches its composition, since business, legal, and risk perspectives are needed for strategic trade-off decisions. Operational tasks such as patching or incident response belong to the security team, not this governance body.

CIS Controls v8 maps its prioritised safeguards into Implementation Groups IG1, IG2 and IG3, letting organisations sequence controls by maturity and risk. It also targets the most common cyber threats, satisfying both the IG-based and common-threat requirements named in the stem.

Escalating per the incident response plan ensures the right stakeholders are engaged and that actions are coordinated, documented, and authorized. Documentation supports forensic analysis, legal requirements, and post-incident review. This step aligns with CISM principles of following established procedures, maintaining chain of custody, and avoiding unilateral actions that could compromise the investigation or business operations.

Crisis classification is driven by potential enterprise-level impact, spanning brand reputation, financial loss, legal or regulatory exposure, and continuity of critical services. When an incident threatens these dimensions beyond the tolerance defined by executive management, the CMT must be activated because response now requires cross-functional executive authority, external communications, and strategic decision-making rather than technical containment alone.

Establishing the risk assessment context defines scope, objectives, criteria and assumptions before any identification or analysis occurs. Without this framing, subsequent risk identification and evaluation lack consistent boundaries, making the context step the necessary first action.

An Information Security Program exists to integrate security controls with organisational goals, ensuring risk is managed at a level the business accepts. It satisfies the stem's requirement by framing security as an enabler of objectives rather than a purely technical or compliance exercise.

IG1 defines essential cyber hygiene safeguards implementable with limited expertise and budget, making it the foundational implementation group. Addressing it first satisfies the small business's resource constraint, as IG2 and IG3 demand greater maturity and staffing.

Before harmonizing anything, the CISO must know where each region stands relative to the target framework. A structured gap assessment produces the factual baseline that prioritization, sequencing, and board reporting all depend on. Jumping to remediation without that baseline risks funding the wrong regions and leaves no defensible measure of progress for the board's comparison objective.

A legal hold suspends routine deletion and triggers preservation obligations, while forensic imaging captures a bit-for-bit copy without altering the original media. Together they satisfy the litigation constraint by keeping evidence admissible and unmodified, which mere containment or continued live analysis would jeopardise.

Mature programs regularly refine processes based on lessons learned.

Often seen when security is perceived as hindering productivity.

Fourth-party risk cannot be assessed directly by the organisation, so contractual flow-down is the practical control. Requiring the vendor to assess its own suppliers and pass through equivalent security requirements extends governance across the supply chain, satisfying the nth-party visibility constraint the stem describes.

Interim compensating controls reduce exposure immediately while the strategic control is deployed. Privileged access reviews, session logging, and least privilege directly address insider misuse of privileged accounts at low cost. This approach balances risk reduction with the budget and timeline constraints and demonstrates due diligence to regulators.

This is correct because a security risk assessment of the target company identifies vulnerabilities, control gaps, and potential threats that could affect the merged entity. It provides the board with the necessary information to make informed decisions about integration and risk mitigation, aligning security with the business objective of a successful merger.

Controls must map to business requirements, which risk assessment and compliance obligations define. This ties spending to the institution's actual risk exposure and regulatory duties, ensuring security supports business objectives rather than technology preferences or vendor defaults.

When recovery exceeds the maximum tolerable downtime, the incident manager must escalate to the BC/DR team and the authority empowered to declare a disaster, since only that authority can activate continuity arrangements and commit resources beyond the IR team's remit. Continuing technical recovery alone would breach the MTD.

Phishing simulation click rate directly measures whether staff apply awareness training by resisting real lures, giving behavioural evidence of programme effectiveness. It satisfies the stem's need for a metric reflecting actual security awareness rather than attendance or completion.

Confirming the IP is genuinely malicious through threat intelligence prevents blocking legitimate business partners or shared infrastructure, which could disrupt operations. Verification establishes attribution and confidence before firewall changes, aligning with the plan's requirement for a defensible blocking decision.

Isolating the workstation is the immediate containment step that stops the malware from communicating with the command-and-control server and prevents potential lateral movement or data exfiltration. This aligns with the containment phase of incident response. Once isolated, the team can conduct a thorough investigation and remediation without the risk of the attacker continuing to operate.

Memory contents and running processes are lost the moment power or network isolation terminates the session, so capturing volatile data first preserves forensic evidence. Containment still proceeds immediately afterwards, satisfying both the investigation and containment objectives.

The CISO owns the information security strategy and programme, aligning security objectives with business goals and reporting to executive leadership. This satisfies the stem's demand for the primary responsibility, distinguishing strategic ownership from operational tasks such as incident response or control implementation delegated to security managers.

Governance begins with an approved strategy, charter, and clear accountability, which give the security programme authority and direction. Establishing these first ensures subsequent risk assessments, policies, and control investments are sanctioned by leadership and aligned with the provider's obligations, rather than emerging piecemeal from technical teams.

Near-miss reporting captures events that could have caused harm but did not, letting the organisation remediate weaknesses before a real incident exploits them. This directly satisfies the stem's proactive purpose by surfacing control gaps early rather than reacting after damage occurs.

A risk assessment identifies threats, vulnerabilities and business impacts, establishing which controls and priorities the programme needs. It satisfies the stem's first-step requirement by grounding the information security programme in the organisation's actual risk profile before policies, controls or budgets are selected.

The first step in risk management is to identify and assess risks. This involves understanding the assets, threats, vulnerabilities, and potential impacts. For an e-commerce platform, this includes risks to customer data, payment processing, and availability. A risk assessment provides the foundation for all subsequent risk management activities, ensuring that controls are applied where they are most needed and that resources are allocated effectively.

Approved policy alone cannot change behaviour; effectiveness depends on awareness. Communicating to all relevant stakeholders and delivering training ensures every affected party understands their obligations, satisfying the governance committee's intent that the policy actually be followed and enforced across the organisation.

The CMT is responsible for strategic decision-making during a crisis, including ensuring business continuity, managing communications with stakeholders, and aligning incident response with organizational objectives. Technical details are important but are inputs to these decisions. The CMT focuses on the big picture, such as whether to shut down systems, how to inform customers, and how to maintain trust.

A pre-negotiated retainer with a forensics firm guarantees specialist capacity and defined rates are available immediately, avoiding procurement delays during containment. This satisfies the stem's requirement that the component be established before an incident occurs, since forensic demand spikes and vendors cannot be onboarded mid-crisis.

Annualised loss expectancy multiplies single loss expectancy by annualised rate of occurrence. A $2 million loss every five years gives an exposure factor of 0.2 per year, yielding $400,000. This satisfies the policy's quantitative requirement by expressing expected annual loss in monetary terms, enabling direct comparison against control costs.

A security steering committee provides a governance structure for cross-functional decision-making and consistent risk management. It ensures that security is aligned with business objectives and that all stakeholders have a voice. This is a foundational step in establishing governance because it creates the mechanism for oversight and direction, enabling the CISO to drive policy, risk appetite, and resource allocation across the enterprise.

Patching directly satisfies the remediation phase of the vulnerability management lifecycle, converting identified weaknesses into resolved risk. A typical programme requires this corrective action alongside discovery and assessment; without remediation, scanning yields no risk reduction. It therefore constitutes a core component, matching the stem's requirement for programme elements.

Correct: Essential before any notification.