Certified Information Security Manager CISM (CISM) — Questions 751–825

When residual risk remains high after all feasible controls are implemented, the information security manager should escalate the risk to senior management for formal risk acceptance (Option A). This aligns with CISM best practices, as senior management holds the authority to accept risks that exceed the organization's risk appetite. Additionally, implementing compensating controls (Option C) can further reduce residual risk to an acceptable level, even if primary controls are already in place.

The number of incidents detected and contained within defined SLAs directly measures the program's ability to detect and respond to threats, which is a key indicator of operational effectiveness. Other metrics may be useful but do not directly measure the program's performance in protecting the organization.

COBIT 2019 emphasizes the alignment of IT and security goals with enterprise goals through a cascading goals cascade. A dashboard that maps security goals to enterprise goals using Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) directly reflects this principle, providing a concise, strategic view of program effectiveness rather than operational details.

Reporting to the CEO or board of directors ensures the information security function operates independently from operational and IT management, preventing conflicts of interest where security decisions could be overridden by cost or performance pressures. This structure aligns with the CISM principle that the CISO must have sufficient authority to enforce security policies across the entire organization without reporting to a function that may prioritize other objectives over security.

Option A is correct because immediate network isolation (e.g., disconnecting the network cable or disabling the switch port) is the highest priority action to contain a confirmed data exfiltration. This stops the ongoing data transfer, preventing further loss while preserving volatile evidence in memory and active connections for later forensic analysis. Incident response frameworks like NIST SP 800-61 emphasize containment before eradication or recovery.

A dotted line reporting to the CIO and solid line to the CEO gives the CISO strategic authority while maintaining operational alignment.

In a P1 ransomware incident, the incident response manager (IRM) is responsible for orchestrating the overall response, prioritizing containment over eradication, and ensuring that executive leadership receives timely, accurate status updates. Unlike technical roles, the IRM owns the incident command structure, coordinates cross-functional teams, and manages communication escalations to stakeholders, which is critical when encrypted servers demand immediate business continuity decisions.

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to rights and freedoms.

Role-based training ensures that each group receives content relevant to their responsibilities.

The first step in the incident response process is to verify the alert to confirm it is not a false positive. Prematurely isolating the server or escalating without validation can disrupt legitimate operations and waste resources. Verification ensures that the incident response team acts on confirmed threats, aligning with the NIST SP 800-61 incident response lifecycle's detection and analysis phase.

Senior management is primarily concerned with financial impact and risk exposure. Estimated financial exposure from unmitigated risks directly translates technical vulnerabilities into monetary terms, enabling informed budget decisions. This aligns with the CISM focus on aligning security programs with business objectives.

Security champions embed security advocates within development teams to promote secure practices.

CIS Controls v8 defines three implementation groups: IG1 (basic cyber hygiene), IG2 (intermediate), and IG3 (advanced) based on organization size and risk.

The firewall rule allowing SSH from any source (0.0.0.0/0) is misconfigured because it permits external attackers to attempt brute-force or credential-based access via TCP port 22. The principle of least privilege dictates that SSH should be restricted to specific internal IP ranges or management jump hosts, not exposed to the internet. The IR team's finding that the attacker gained access via SSH from an external IP directly confirms this rule as the root cause.

Legal counsel ensures that actions taken during an incident preserve attorney-client privilege and comply with legal obligations, such as breach notification and litigation holds.

Comparing security investment to potential loss avoidance quantifies ROI in business terms.

A pre-established retainer reduces the time to engage a forensics firm during an incident, ensuring rapid response.

Without Business Operations representation, the security steering committee lacks direct insight into how security policies will interact with day-to-day operational workflows. This gap often results in policies that are technically sound but impractical to implement, causing misalignment with existing processes and potential operational friction.

The correct answer is D because svchost.exe is a critical Windows system process that should never run from the Temp folder. Running svchost.exe from %TEMP% is a classic indicator of malware masquerading as a legitimate process, often used to evade detection by security tools that trust the svchost.exe name. This event strongly suggests a malicious binary attempting to blend in with normal system activity.

Leading indicators are proactive measures that predict future performance; phishing click rate reflects current behavior that influences future security incidents.

Option A is correct because defining and reporting security risk appetite to the board is a foundational governance activity that ensures executive oversight and alignment of risk tolerance with business strategy. In a mature governance process, the board must formally approve and periodically review the risk appetite statement, which directly influences resource allocation and control prioritization. This aligns with the ISACA CISM framework, which emphasizes that governance requires board-level engagement with risk appetite as a key performance indicator.

To manage nth-party risk, the programme should require vendors to disclose their subcontractors, include contractual clauses flowing down security requirements, and have the right to audit subcontractors. Assessing all suppliers' suppliers is impractical; focusing on high-risk vendors is more feasible.

For critical incidents, hourly sitreps (situation reports) are recommended to keep executives informed. Avoiding speculation and preserving legal privilege with counsel involvement are also key.

When an incident cannot be resolved within MTD, the organization should escalate to business continuity and disaster recovery activation to restore operations.

Role-based training tailors content to job functions, and phishing simulations with remediation training reinforce learning.

Frequent changes to security policies without approval (Option B) indicate a breakdown in governance because it shows that the policy lifecycle—creation, review, approval, and communication—is not being followed. Without a formal change control process, policies become inconsistent, unenforceable, and may conflict with regulatory requirements, directly undermining the governance framework's authority and accountability.

A one-page dashboard for the C-suite should include both leading and lagging indicators that provide a high-level view of security posture, such as patch compliance (leading) and mean time to detect (lagging).

P2 incidents are high severity with significant impact, requiring management notification and response during business hours.

Option D is correct because a risk appetite statement for a financial institution must be quantifiable and specific to operational risk, aligning with regulatory frameworks like Basel III which require explicit loss thresholds. Stating a maximum acceptable loss of $5M provides a clear, measurable boundary for risk-taking decisions, enabling the board and management to balance risk and reward effectively.

A security steering committee with executive representation is essential because it provides strategic oversight, aligns security initiatives with business objectives, and ensures resource allocation and governance accountability. This committee typically includes C-level executives who approve security policies, review risk posture, and enforce compliance across the organization.

Conducting a post-incident review and updating policies is the most critical post-incident activity because it ensures that the root cause, response gaps, and process deficiencies are formally documented and translated into actionable improvements. This directly supports the continuous improvement cycle required by NIST SP 800-61 and ISO 27035, preventing recurrence of similar incidents.

After approval, training and awareness are essential to ensure employees understand and comply with the policy.

The most appropriate metric for measuring the effectiveness of security awareness training is the reduction in security incidents caused by human error. While completion rates and test scores measure participation and knowledge retention, they do not directly indicate whether the training has changed employee behavior and reduced real-world risk. A decrease in human-error-related incidents provides direct evidence that the training is effectively influencing secure practices.

Option B is correct because the crisis management team (CMT) is responsible for high-level strategic decisions, including approving external communications and public statements to manage reputation and legal exposure during a major cybersecurity incident. This aligns with the CMT's role in coordinating response efforts and ensuring consistent messaging, as defined in incident management frameworks like NIST SP 800-61.

The correct next step is to change the password for the service account because the alert indicates a possible brute-force attack, and a known password represents a compromised credential. Even if the account is a service account, the password must be rotated to prevent unauthorized access. This aligns with the incident response principle of containing the threat by invalidating the compromised authentication factor.

Encryption is a fundamental control for protecting data at rest. While DLP and access controls are important, encryption provides direct confidentiality protection.

Data access and service criticality directly affect the potential impact of a vendor compromise.

Mean Time to Detect (MTTD) measures the average time between the occurrence of an incident and its detection by monitoring systems or personnel. A lower MTTD indicates faster detection, which is critical for minimizing damage and is a direct KPI for incident management effectiveness. Mean Time to Respond (MTTR) measures the average time from detection to the start of remediation actions, reflecting the efficiency of the response process.

Risk avoidance is a defined risk treatment strategy in ISO 27005 where the organization decides to avoid the risk by not engaging in the activity that gives rise to it, such as discontinuing a service or choosing an alternative technology. Option C is correct because ISO 27005 explicitly lists risk avoidance as one of the four primary risk treatment options (avoidance, reduction, retention, and transfer).

Option A is correct because documenting lessons learned and improvement actions is a core output of a post-incident review, enabling the organization to refine security controls, processes, and training. This practice aligns with the continuous improvement cycle in incident management, ensuring that each incident contributes to stronger defenses. Without this documentation, the same vulnerabilities or procedural gaps may be exploited repeatedly.

Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.

The IR plan includes the IR team roster and contact list, and communication templates. Procedures for specific incident types are typically in separate playbooks.

Presenting the return on investment (ROI) by quantifying avoided breach costs and compliance savings provides a business case for budget increases.

Essential components include the IR team roster and contact list, and communication templates for consistent messaging.

A P2 (high) incident requires a response during business hours with management notification, as defined by the incident severity classification. This ensures that the incident is addressed promptly within operational hours while keeping management informed for potential escalation or resource allocation.

These metrics provide strategic insight into security effectiveness and compliance.

Option C is correct because the first step in incident response is to preserve evidence and follow the established escalation path. The analyst should document the observation (including source/destination IPs, ports, protocols, and timestamps) and escalate to the incident response team (IRT) to ensure a coordinated, forensically sound investigation. Premature action like blocking or isolating could destroy volatile data or alert an attacker, violating the principle of evidence preservation outlined in NIST SP 800-61.

The '5 Whys' should drill deeper to uncover process and management failures that allowed the technical vulnerability to exist.

A hybrid model combines the benefits of centralized oversight with decentralized execution, ensuring consistency while maintaining business unit flexibility.

Developers need secure coding and threat modeling to build secure applications.

Sharing IoCs with an ISAC (Information Sharing and Analysis Center) helps the broader community defend against similar attacks, which is a key post-incident activity.

Phishing simulations and role-based training are core components of awareness programs. Penetration testing is a technical assessment, vulnerability scanning is technical, and security architecture is a design function.

Option C is correct because timely implementation of risk treatment plans directly demonstrates that the organization is actively managing identified risks according to its risk appetite and governance framework. Effective governance requires not just planning but execution; a high percentage of on-time plan completion indicates that risk owners are accountable and that the risk management process is operational, which is a core objective of information security governance.

Risk avoidance is a valid risk treatment option per ISO 31000, where the organization decides to eliminate the risk by not engaging in or discontinuing the activity that gives rise to the risk. For example, in information security, this could mean choosing not to deploy a vulnerable legacy system or terminating a high-risk third-party integration. It directly reduces exposure to zero for that specific risk scenario.

The information security manager is responsible for designing and managing the security program based on the risk management framework. This includes translating risk assessment results into security controls, policies, and procedures, and ensuring the program aligns with the organization's risk posture. The manager does not set risk appetite (that is a board-level decision) nor own all risks (risk owners are business process owners).

Option A is correct because escalation procedures define the specific thresholds and contact paths for notifying management and legal teams when an incident exceeds predefined severity levels. This ensures that decision-makers are informed promptly to authorize critical actions like legal holds or regulatory notifications, preventing delays that could worsen the incident's impact.

Disabling compromised accounts is an essential containment step because it immediately cuts off an attacker's authenticated access to systems, preventing further lateral movement or data exfiltration. In Active Directory environments, this involves disabling the user or computer account via `Disable-ADAccount` or the GUI, which invalidates Kerberos tickets and NTLM hashes for that account. This action stops the attacker from using stolen credentials without destroying evidence of their activity.

PCI DSS applies to payment card processing, and GDPR applies to personal data of EU residents. These are the two most relevant regulations.

The CMT includes senior leaders such as the CEO, CFO, CISO, General Counsel, and Communications head to handle strategic decisions and external communications.

In a small business lacking a dedicated incident response team, the external cybersecurity consultant on retainer (Option C) is the most appropriate leader because they possess the specialized expertise, tools, and experience required to manage the technical aspects of incident response, such as forensic analysis, containment, and eradication. The consultant can provide an objective, skilled response without the conflicts of interest or lack of training that internal staff may have, ensuring adherence to industry frameworks like NIST SP 800-61 or SANS PICERL.

Insider threats require specific playbooks and involvement of HR and legal for proper handling.

During a P1 incident, the CEO requires a concise, actionable sitrep focused on containment status, confirmed facts, and actions taken. Legal counsel input is critical to avoid premature attribution or disclosure that could create liability or violate data breach notification laws. This aligns with the CISM incident management principle of providing decision-ready information to executive leadership without technical clutter.

Risk appetite is the broad, high-level amount of risk an organization is willing to accept in pursuit of its objectives, while risk tolerance translates that appetite into specific, measurable boundaries for individual risks. Option D correctly captures this relationship: appetite is the general approach, and tolerance defines the acceptable variation in performance metrics (e.g., a 5% deviation in revenue targets). This distinction is critical for aligning risk management with business strategy in information security risk management.

Leading indicators predict future performance. Patch compliance measures proactive security posture.

P1 (critical) incidents have major business impact and require executive notification and around-the-clock response.

The communication and escalation matrix is a key component of an incident response plan because it defines the chain of command, contact paths, and escalation triggers for notifying stakeholders during an incident. This ensures that the right people are informed at the right time, preventing delays in decision-making and response actions. Without this matrix, critical incidents may be mishandled due to miscommunication or failure to escalate to senior management or legal teams.