Certified Information Security Manager CISM (CISM) — Questions 751–825

Leading indicators are proactive measures that predict future performance; phishing click rate reflects current behavior that influences future security incidents.

Defining and reporting security risk appetite to the board is a foundational governance activity that ensures executive oversight and alignment of risk tolerance with business strategy. In a mature governance process, the board must formally approve and periodically review the risk appetite statement, which directly influences resource allocation and control prioritization. This aligns with the ISACA CISM framework, which emphasizes that governance requires board-level engagement with risk appetite as a key performance indicator.

To manage nth-party risk, the programme should require vendors to disclose their subcontractors, include contractual clauses flowing down security requirements, and have the right to audit subcontractors. Assessing all suppliers' suppliers is impractical; focusing on high-risk vendors is more feasible.

For critical incidents, hourly sitreps (situation reports) are recommended to keep executives informed. Avoiding speculation and preserving legal privilege with counsel involvement are also key.

When an incident cannot be resolved within MTD, the organization should escalate to business continuity and disaster recovery activation to restore operations.

Role-based training tailors content to job functions, and phishing simulations with remediation training reinforce learning.

Frequent changes to security policies without approval (Option B) indicate a breakdown in governance because it shows that the policy lifecycle—creation, review, approval, and communication—is not being followed. Without a formal change control process, policies become inconsistent, unenforceable, and may conflict with regulatory requirements, directly undermining the governance framework's authority and accountability.

A one-page dashboard for the C-suite should include both leading and lagging indicators that provide a high-level view of security posture, such as patch compliance (leading) and mean time to detect (lagging).

P2 incidents are high severity with significant impact, requiring management notification and response during business hours.

A risk appetite statement for a financial institution must be quantifiable and specific to operational risk, aligning with regulatory frameworks like Basel III which require explicit loss thresholds. Stating a maximum acceptable loss of $5M provides a clear, measurable boundary for risk-taking decisions, enabling the board and management to balance risk and reward effectively.

A security steering committee with executive representation is essential because it provides strategic oversight, aligns security initiatives with business objectives, and ensures resource allocation and governance accountability. This committee typically includes C-level executives who approve security policies, review risk posture, and enforce compliance across the organization.

Conducting a post-incident review and updating policies is the most critical post-incident activity because it ensures that the root cause, response gaps, and process deficiencies are formally documented and translated into actionable improvements. This directly supports the continuous improvement cycle required by NIST SP 800-61 and ISO 27035, preventing recurrence of similar incidents.

After approval, training and awareness are essential to ensure employees understand and comply with the policy.

The most appropriate metric for measuring the effectiveness of security awareness training is the reduction in security incidents caused by human error. While completion rates and test scores measure participation and knowledge retention, they do not directly indicate whether the training has changed employee behavior and reduced real-world risk. A decrease in human-error-related incidents provides direct evidence that the training is effectively influencing secure practices.

The crisis management team (CMT) is responsible for high-level strategic decisions, including approving external communications and public statements to manage reputation and legal exposure during a major cybersecurity incident. This aligns with the CMT's role in coordinating response efforts and ensuring consistent messaging, as defined in incident management frameworks like NIST SP 800-61.

The correct next step is to change the password for the service account because the alert indicates a possible brute-force attack, and a known password represents a compromised credential. Even if the account is a service account, the password must be rotated to prevent unauthorized access. This aligns with the incident response principle of containing the threat by invalidating the compromised authentication factor.

Encryption is a fundamental control for protecting data at rest. While DLP and access controls are important, encryption provides direct confidentiality protection.

Data access and service criticality directly affect the potential impact of a vendor compromise.

Mean Time to Detect (MTTD) measures the average time between the occurrence of an incident and its detection by monitoring systems or personnel. A lower MTTD indicates faster detection, which is critical for minimizing damage and is a direct KPI for incident management effectiveness. Mean Time to Respond (MTTR) measures the average time from detection to the start of remediation actions, reflecting the efficiency of the response process.

Risk avoidance is a defined risk treatment strategy in ISO 27005 where the organization decides to avoid the risk by not engaging in the activity that gives rise to it, such as discontinuing a service or choosing an alternative technology. Option C is correct because ISO 27005 explicitly lists risk avoidance as one of the four primary risk treatment options (avoidance, reduction, retention, and transfer).

Documenting lessons learned and improvement actions is a core output of a post-incident review, enabling the organization to refine security controls, processes, and training. This practice aligns with the continuous improvement cycle in incident management, ensuring that each incident contributes to stronger defenses. Without this documentation, the same vulnerabilities or procedural gaps may be exploited repeatedly.

Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.

The IR plan includes the IR team roster and contact list, and communication templates. Procedures for specific incident types are typically in separate playbooks.

Presenting the return on investment (ROI) by quantifying avoided breach costs and compliance savings provides a business case for budget increases.

Essential components include the IR team roster and contact list, and communication templates for consistent messaging.

A P2 (high) incident requires a response during business hours with management notification, as defined by the incident severity classification. This ensures that the incident is addressed promptly within operational hours while keeping management informed for potential escalation or resource allocation.

These metrics provide strategic insight into security effectiveness and compliance.

The first step in incident response is to preserve evidence and follow the established escalation path. The analyst should document the observation (including source/destination IPs, ports, protocols, and timestamps) and escalate to the incident response team (IRT) to ensure a coordinated, forensically sound investigation. Premature action like blocking or isolating could destroy volatile data or alert an attacker, violating the principle of evidence preservation outlined in NIST SP 800-61.

The '5 Whys' should drill deeper to uncover process and management failures that allowed the technical vulnerability to exist.

A hybrid model combines the benefits of centralized oversight with decentralized execution, ensuring consistency while maintaining business unit flexibility.

Developers need secure coding and threat modeling to build secure applications.

Sharing IoCs with an ISAC (Information Sharing and Analysis Center) helps the broader community defend against similar attacks, which is a key post-incident activity.

Phishing simulations and role-based training are core components of awareness programs. Penetration testing is a technical assessment, vulnerability scanning is technical, and security architecture is a design function.

Timely implementation of risk treatment plans directly demonstrates that the organization is actively managing identified risks according to its risk appetite and governance framework. Effective governance requires not just planning but execution; a high percentage of on-time plan completion indicates that risk owners are accountable and that the risk management process is operational, which is a core objective of information security governance.

Risk avoidance is a valid risk treatment option per ISO 31000, where the organization decides to eliminate the risk by not engaging in or discontinuing the activity that gives rise to the risk. For example, in information security, this could mean choosing not to deploy a vulnerable legacy system or terminating a high-risk third-party integration. It directly reduces exposure to zero for that specific risk scenario.

The information security manager is responsible for designing and managing the security program based on the risk management framework. This includes translating risk assessment results into security controls, policies, and procedures, and ensuring the program aligns with the organization's risk posture. The manager does not set risk appetite (that is a board-level decision) nor own all risks (risk owners are business process owners).

Escalation procedures define the specific thresholds and contact paths for notifying management and legal teams when an incident exceeds predefined severity levels. This ensures that decision-makers are informed promptly to authorize critical actions like legal holds or regulatory notifications, preventing delays that could worsen the incident's impact.

PCI DSS applies to payment card processing, and GDPR applies to personal data of EU residents. These are the two most relevant regulations.

The CMT includes senior leaders such as the CEO, CFO, CISO, General Counsel, and Communications head to handle strategic decisions and external communications.

In a small business lacking a dedicated incident response team, the external cybersecurity consultant on retainer (Option C) is the most appropriate leader because they possess the specialized expertise, tools, and experience required to manage the technical aspects of incident response, such as forensic analysis, containment, and eradication. The consultant can provide an objective, skilled response without the conflicts of interest or lack of training that internal staff may have, ensuring adherence to industry frameworks like NIST SP 800-61 or SANS PICERL.

Aligning security metrics with key business performance indicators (KPIs) ensures that security initiatives directly support and demonstrate value to business objectives, such as revenue protection, customer trust, or operational efficiency. This is a core principle of information security governance, where security is treated as a business enabler rather than a technical silo. For example, tracking 'mean time to detect (MTTD)' and 'mean time to respond (MTTR)' as security metrics linked to business continuity KPIs shows how security investments reduce business risk.

Insider threats require specific playbooks and involvement of HR and legal for proper handling.

During a P1 incident, the CEO requires a concise, actionable sitrep focused on containment status, confirmed facts, and actions taken. Legal counsel input is critical to avoid premature attribution or disclosure that could create liability or violate data breach notification laws. This aligns with the CISM incident management principle of providing decision-ready information to executive leadership without technical clutter.

Risk appetite is the broad, high-level amount of risk an organization is willing to accept in pursuit of its objectives, while risk tolerance translates that appetite into specific, measurable boundaries for individual risks. Option D correctly captures this relationship: appetite is the general approach, and tolerance defines the acceptable variation in performance metrics (e.g., a 5% deviation in revenue targets). This distinction is critical for aligning risk management with business strategy in information security risk management.

Leading indicators predict future performance. Patch compliance measures proactive security posture.

P1 (critical) incidents have major business impact and require executive notification and around-the-clock response.

The communication and escalation matrix is a key component of an incident response plan because it defines the chain of command, contact paths, and escalation triggers for notifying stakeholders during an incident. This ensures that the right people are informed at the right time, preventing delays in decision-making and response actions. Without this matrix, critical incidents may be mishandled due to miscommunication or failure to escalate to senior management or legal teams.

The IR team typically includes an IR manager, security analysts, forensic investigators, communications lead, legal counsel, and executive sponsor.

The manager should add legal counsel to the communication plan immediately to ensure they are included in future incidents. Ignoring them or delaying notification could worsen regulatory consequences. Using internal legal might not be sufficient for external counsel needs.

The lifecycle includes analysis, consultation, drafting, review, approval, training, and monitoring.

A unified privacy framework (e.g., ISO/IEC 27701 or NIST Privacy Framework) allows the organization to map overlapping requirements from GDPR and CCPA into a single set of controls, reducing duplication and ensuring consistent data protection across jurisdictions. This approach leverages common principles like data minimization, consent management, and breach notification, which are foundational to both regulations, while accommodating specific differences such as GDPR's 72-hour breach notification versus CCPA's broader definition of personal information.

The CEO provides strategic direction and approves major decisions, such as activating business continuity or communicating externally, while the CISO leads the technical response.

The SYSTEM account is the highest-privileged local account on Windows, and outbound connections from a server that normally only communicates internally strongly indicate a backdoor. A backdoor installed via a previous compromise would allow an attacker to maintain persistent remote access, often running as SYSTEM to evade detection and control the server. This matches the observed behavior of unauthorized outbound traffic from a privileged process.

The security architect designs and oversees the implementation of security solutions and ensures they align with the overall architecture.

Strategy must be driven by business needs, risk appetite, and regulatory requirements.

Directing forensic investigators to report directly to legal counsel and marking all deliverables as privileged establishes a clear legal framework for attorney-client privilege. This ensures that communications and work product are protected from discovery in litigation, as they are created under the direction of legal counsel for the purpose of providing legal advice.

IR policy and IR plan are core components; vendor contacts are part of the plan, and BIA is not a direct IR component.

A roadmap should include milestones, resource allocation, and alignment with business objectives to guide implementation over time.

P2 incidents require management notification and response during business hours.

Conducting the meeting within two weeks ensures details are fresh and improvements can be implemented quickly.

A sustained low click rate over time, with increasing or stable reporting rates, is a leading indicator of improved security awareness. A decreasing click rate alone may be confounded by other factors, but combined with reporting trends it shows behavioral change.

To preserve attorney-client privilege, communications and work product must be kept confidential and not shared with third parties unless protected by common interest or waiver.

Developing and communicating a revised risk appetite statement approved by the board directly addresses the need to formalize risk management and change the risk culture. It provides clear guidance for decision-making, aligns with the board's demands, and respects the startup's limited resources by focusing on policy first. Other options are premature: deploying technical controls without policy support may be ineffective, outsourcing does not change internal culture, and terminating the CEO is an HR action that does not establish a risk program.

For a mature security programme, industry benchmarks suggest 10-15% of IT budget. For a $10M IT budget, that is $1M to $1.5M. 0.2-0.5% of revenue is another benchmark but not directly applicable here without revenue data.

Quantifying the financial impact of risks avoided (e.g., using annualized loss expectancy) provides a compelling business case.

Leading indicators (patch compliance) predict future performance, while lagging indicators (breach count) measure past outcomes. Both are needed for balance.