Certified Information Security Manager CISM (CISM) — Questions 151–225

An effective security governance framework must include clear roles and responsibilities to ensure accountability, and a process for regularly updating policies to adapt to changes. These components provide the structure and adaptability needed to align security with business objectives and manage risk. Advanced technologies, centralized decision-making, and operational centers are not core governance elements; they are tactical or operational considerations that support the framework.

Security awareness training is the most cost-effective initial investment because human error remains the leading cause of security incidents, especially in resource-constrained environments. By educating employees on phishing, social engineering, and safe data handling, the organization reduces the attack surface without requiring expensive tools or specialized staff. This foundational control directly addresses the most common threat vector—user behavior—which automated systems alone cannot fully mitigate.

Conducting a risk assessment is the foundational first step because it identifies and prioritizes the specific threats and vulnerabilities facing the healthcare organization's sensitive data (e.g., PHI under HIPAA). Without this baseline understanding, any subsequent policies, controls, or metrics would be misaligned with actual risk exposure, leading to ineffective or wasteful security investments.

A governance structure with defined roles, responsibilities, and oversight (Option B) is critical because it provides the authority, accountability, and decision-making framework needed to align security activities with diverse business units and regulatory requirements. Without clear governance, the program lacks the mechanisms to enforce policies, manage exceptions, and adapt to regional legal variations, such as GDPR in Europe or CCPA in California.

The analyst should escalate the unauthorized privileged account change through the documented incident classification and escalation procedures. This ensures the incident receives appropriate resources and is handled consistently, while preserving evidence and avoiding premature or unilateral actions. Reversing the change, contacting the user, or simply monitoring can compromise the investigation or allow the attacker to expand access.

Mean time to detect (MTTD) and mean time to respond (MTTR) are outcome-based metrics that directly reflect the program's ability to detect and respond to threats. They are meaningful to the board because they quantify operational effectiveness and can be benchmarked. Other metrics like incident counts or control counts do not provide the same level of assurance regarding detection and response capabilities.

Business objectives are the primary driver for defining security objectives because information security exists to enable the organization to achieve its mission and strategic goals. Security objectives must align with and support business objectives to ensure that resources are allocated effectively and that security controls are prioritized based on risk to the business, not just compliance or generic practices.

When an incident may involve criminal conduct or regulatory breach notification, the security manager's immediate priority is to engage legal counsel and preserve evidence. This ensures the organization can support law enforcement, defend against liability, and meet notification requirements. Containment has already occurred, so the next step is protecting the integrity of the investigation rather than taking destructive or premature personnel actions.

The annualized loss expectancy (ALE) is calculated as ALE = AV × EF × ARO, where AV is the asset value ($2,000,000), EF is the exposure factor (0.25), and ARO is the annualized rate of occurrence (0.5). Multiplying these gives $2,000,000 × 0.25 × 0.5 = $250,000, which represents the expected annual financial loss from this risk.

Patching the specific vulnerability is the most critical action during the eradication phase because it permanently removes the root cause of the breach. Without this step, the same attack vector (e.g., an unpatched SQL injection flaw or a known CVE in a web server) remains exploitable, rendering containment efforts temporary. The CISO's goal to prevent recurrence directly requires eliminating the technical weakness, not just mitigating its symptoms.

A P1 data breach involving customer PII triggers mandatory breach notification laws (e.g., GDPR Article 33, HIPAA Breach Notification Rule) and often requires immediate CMT activation to manage regulatory filings, legal liability, and public relations. The CMT is designed for high-severity incidents with significant business, legal, or reputational consequences, which a P1 breach directly entails.

A change of control at a critical vendor is a risk event that must be reassessed before any treatment decision. Because the contract lacks a change-of-control clause, the organization cannot rely on contractual levers and must understand the new legal, privacy, and operational exposure. Assessing first supports an informed choice among renegotiation, added controls, or managed exit, and preserves evidence of due diligence.

Firewalls operate at the network layer (Layer 3) and transport layer (Layer 4) to filter traffic based on IP addresses, ports, and protocols, preventing unauthorized network access. They are a core component of defense-in-depth at the network perimeter and internal segments. This directly matches the requirement for network-layer protection.

Percentage of user access reviews completed on time is a leading indicator because it measures a proactive governance activity that reduces the risk of excessive or inappropriate access before it can be exploited. Completing reviews on time predicts better access control hygiene and lower future incident likelihood. The other options are lagging indicators that report past incidents or their costs.

The most important factor when reviewing an exception request to bypass a critical control is the residual risk after compensating controls. This ensures that the organization's risk appetite is not exceeded and that the compensating controls adequately mitigate the risk to an acceptable level, as required by frameworks like ISO 27001 and NIST SP 800-53.

Including security metrics in regular executive reports demonstrates that security performance is being measured, tracked, and communicated to leadership as part of ongoing governance. This aligns with a mature security program where security is integrated into business decision-making, not treated as a siloed technical function.

A formal security charter approved by executive management is the most important first step because it establishes the program's authority, scope, and resources. It ensures that security is aligned with business objectives and provides the CISO with the mandate to implement and enforce the program. Without this foundation, other activities may lack support and effectiveness.

Before a risk can be accepted, the cost-benefit analysis must be validated, and acceptance must be authorized by the appropriate level of management based on the risk score. The security manager's role is to facilitate this process, ensuring that the decision is informed and within governance. Thus, validating the analysis and obtaining proper authorization is the correct next step.

The lessons learned meeting aims to identify improvements to the incident response process.

In a decentralized governance model, each business unit manages its own security, which leads to inconsistent policies, controls, and risk postures across the organization. This fragmentation makes it difficult to enforce enterprise-wide standards, aggregate risk, and demonstrate compliance. The key challenge is the lack of uniformity and coordination, not cost or speed.

The governance policy lacks a role with explicit authority to enforce compliance and impose consequences, which is essential for accountability. Without such enforcement, policies become aspirational rather than binding, as no mechanism exists to address non-compliance or ensure corrective actions. This aligns with the CISM principle that governance requires clear accountability structures, including disciplinary measures for violations.

A gap analysis against the combined requirements of PCI DSS and GDPR identifies exactly where each legacy program falls short, allowing the CISO to prioritize remediation based on risk and regulatory obligation. This is the standard, defensible approach for harmonizing programs during M&A because it is evidence-based, accounts for differing maturity levels, and produces a prioritized roadmap rather than a blunt consolidation. It also respects that the two regulations have different scopes (PCI DSS for cardholder data, GDPR for personal data of EU residents).

Communication templates ensure that notifications are consistent, accurate, and timely during the stress of an incident, reducing the risk of errors or omissions.

A hybrid governance model combines central oversight with distributed execution: a central security team sets policies, standards, and provides oversight, while business units execute security operations tailored to their needs. This balances consistency with business agility. It is the defining characteristic of a federated or hybrid approach.

A credible awareness measurement approach combines behavioural evidence from phishing simulations with participation data from training completion and comprehension checks from knowledge assessments. Together these show whether staff can recognise threats and act correctly, and they reveal where reinforcement is needed. This mix produces the trend evidence boards need to judge whether the programme is reducing human risk over time.

Monetary value of potential losses (A) is correct because it translates technical risk into financial terms that board members understand, enabling informed decisions on resource allocation for risk mitigation. This aligns with the CISM focus on business-aligned risk communication, where quantitative metrics like Annualized Loss Expectancy (ALE) directly support cost-benefit analysis.

Security should be involved from the requirements gathering phase to ensure that security requirements are identified and incorporated early. This proactive approach reduces costs and risks. Later phases are for validation and verification, but they cannot compensate for missing requirements.

The communications lead on a Crisis Management Team (CMT) is specifically designated to own the communications function during an incident — both internal (employees, executives, board) and external (customers, media, regulators, law enforcement). This role ensures a single, consistent, approved message is delivered to all stakeholders, preventing conflicting or premature disclosures that could escalate reputational and legal exposure.

Admissibility of digital evidence in court hinges on demonstrating that the evidence has not been tampered with from the moment of collection to presentation. The chain of custody is the legally mandated documentation that tracks every person who handled the evidence, the time and date of each transfer, and the purpose of each action. Without a complete and verifiable chain of custody, the opposing counsel can successfully argue that the evidence may have been altered, making it inadmissible regardless of how securely it was stored or imaged.

Reporting to the board or risk committee provides the CISO with an independent reporting line that is not subordinate to the CIO or other executives whose priorities may conflict with security. This structure ensures security concerns are elevated to a governance body with fiduciary oversight, reducing the likelihood that security initiatives are deprioritized due to operational or budgetary conflicts. It also aligns with governance best practices that separate security oversight from IT delivery.

An analysis of potential financial impact and risk mitigation directly aligns the security program with business objectives by showing how it protects revenue and reputation. Executives are more likely to fund initiatives that clearly address business risk and demonstrate a return on investment. This approach makes the business case compelling and strategic.

Board-level risk acceptance is triggered when residual risk exceeds the appetite and tolerance thresholds that executive management has established. Inherent scores, business criticality, and remediation delays are inputs to analysis but do not by themselves indicate that a decision above delegated authority is required. Routing only appetite-breaching residual risks keeps the committee focused on exposures that genuinely require formal acceptance.

Return on investment (ROI) from avoided breach costs translates security spending into financial terms that the board understands, showing how investments prevent losses. This metric directly ties security to business value by quantifying the cost avoidance from prevented incidents, which is more compelling than activity-based metrics. Boards are accountable for financial performance and risk, so ROI resonates with their fiduciary responsibilities.

P1 (critical) incidents have the highest severity and require immediate, around-the-clock response.

Holding the lessons learned meeting within about two weeks of resolution balances memory freshness with enough time to gather facts and complete preliminary analysis. It is soon enough that details are still accurate but late enough that the team is no longer in firefighting mode. This aligns with common IR frameworks like NIST SP 800-61.

The most important element is a security governance committee with representation from all business units, reporting to the board. This committee provides the structure for consistent risk management, oversight, and accountability across the organization. It ensures that security risks are considered in business decisions and gives the board a direct line of sight into how risks are being managed, which is essential for effective governance.

The risk register entry indicates that a mobile device management (MDM) policy exists but is not enforced through technical controls, such as device compliance checks or automated policy application. This creates a gap because the policy remains a paper-based directive without active enforcement mechanisms like certificate-based authentication or conditional access rules, leaving devices vulnerable to non-compliance and potential data breaches.

The best approach is to establish a common security framework and governance model that sets minimum standards while allowing flexibility. This hybrid model enables consistent risk management and compliance across the organization, reduces duplication, and respects business unit autonomy. It aligns with CISM principles of balancing enterprise-wide security with business-specific needs.

The Technical Lead is responsible for conducting forensic analysis because they possess the deep technical expertise required to preserve, acquire, and examine digital evidence without altering its integrity. In incident response, the Technical Lead oversees the technical team, ensuring that chain-of-custody procedures are followed and that forensic tools (e.g., FTK Imager, EnCase, or dd for disk imaging) are correctly applied to capture volatile and non-volatile data.

The correct answer is the reduction in likelihood of material breaches affecting critical business processes. This metric translates security efforts into business terms by focusing on risk reduction for what matters most. It demonstrates that the program is not just implementing controls but actively protecting the organization's ability to achieve its objectives, which is the essence of business value.

An effective information security governance framework must include a documented risk appetite statement approved by executive management and a comprehensive set of security policies and standards. The risk appetite guides risk-based decisions and ensures alignment with business strategy, while policies and standards establish the rules and expectations for protecting information. These components provide direction, oversight, and accountability, which are the hallmarks of governance.

The risk owner is the individual within a business unit who is accountable for ensuring that information security risks are identified, assessed, and managed. This role owns the risk treatment plan and is responsible for implementing controls to reduce risk to an acceptable level, as defined by the organization's risk appetite.

The immediate response to a brute-force attack from a single external IP is to block that IP at the firewall. This stops the attack at the network perimeter, preventing further authentication attempts without affecting legitimate users (assuming the IP is not a known legitimate source). Delaying action could allow the attacker to compromise an account via password guessing, especially since common usernames are being targeted.

The governance committee's failure to meet for six months directly undermines the strategic alignment of security initiatives with business objectives. Without regular oversight, security investments and priorities may drift from the organization's risk appetite and strategic goals, leading to misallocation of resources and increased exposure to unmanaged risks. This misalignment is the most significant risk because it affects the entire security program's effectiveness and long-term viability.

When compromised credentials are identified during an incident, the immediate priority is to contain the threat by disabling the compromised credentials to prevent further unauthorized access, and then to initiate a forensic investigation to determine the scope, method, and impact of the breach. Option D correctly follows the incident response containment and investigation phases, ensuring that evidence is preserved and the attack vector is understood before any notification or contractual actions are taken.

When legal action is anticipated, evidence preservation becomes a formal obligation that must be balanced against service restoration. The incident response manager should engage legal counsel to confirm preservation requirements, then select a containment or recovery method that keeps evidence intact, such as imaging the server or rebuilding on alternate infrastructure. This coordinated approach protects both operational continuity and the organization's legal position, avoiding the extremes of reckless destruction or unnecessary service outage.

The primary purpose of an information security governance committee is to ensure that the security strategy aligns with business objectives and to provide oversight. This committee does not execute day-to-day operations or implement controls; instead, it sets direction, reviews risk posture, and ensures that security investments support organizational goals, as defined in frameworks like COBIT and ISO 38500.

Issuing a legal hold is the first action because it triggers the duty to preserve evidence and suspends normal data retention or deletion policies, ensuring that logs, disk images, and other artifacts are not destroyed. Under FRCP and similar rules, once litigation is reasonably anticipated, spoliation of evidence can lead to sanctions, so the legal hold must precede any remediation or notification. This step also formally directs custodians and IT staff to retain relevant records, creating a defensible chain of custody.

Because the residual risk exceeds the board-defined threshold of 12, the CISO must escalate it to the risk committee for a formal treatment decision. The most appropriate first action is to present the risk along with viable treatment options, costs, and business impacts so the committee can make an informed choice. This respects governance, ensures accountability, and provides the decision-makers with the information they need.

The primary purpose of a pre-established contract with a digital forensics firm is to eliminate procurement delays during an incident. When an incident occurs, time is critical; having a signed contract in place allows the firm to be engaged immediately without waiting for legal or administrative approvals, which directly supports the incident response goal of minimizing damage and preserving evidence.

When the adversary is positioned to observe the organization's normal communication paths, coordination must shift to a channel the adversary cannot reach. An out-of-band method that was designed, provisioned, and exercised before the incident provides that assurance, keeping containment strategy, evidence handling, and executive decisions confidential while normal platforms are treated as untrusted.

Defense in depth requires multiple, layered controls across different domains so that if one fails, others still protect the asset. Network segmentation, intrusion detection systems, and full-disk encryption represent layers across network, monitoring, and data-at-rest controls, covering different attack vectors. This combination exemplifies the principle by providing preventive, detective, and protective controls that complement each other.

Effective risk management supports business objectives by making risk visible and manageable rather than by blocking initiatives. Assessing the launch against the new regulations and presenting treatment options with their business impact allows leadership to weigh speed against compliance exposure and make a documented, risk-aware decision within their authority.

The primary driver for aligning the security program with business objectives is to ensure that security initiatives directly support and enable the organization's strategic goals. Without this alignment, security becomes a cost center rather than a business enabler, and resources may be misallocated to activities that do not advance the enterprise's mission. CISM emphasizes that security governance must be integrated with business strategy to justify investment and demonstrate value to stakeholders.

The incident response plan (IRP) is the overarching document that defines the organization's strategy, structure, roles, and responsibilities for handling incidents end to end. It establishes who does what across the full lifecycle — preparation, detection, containment, eradication, recovery, and lessons learned. The policy sets intent at a high level, while the plan operationalizes that intent with assigned roles and coordination procedures.

The exhibit shows a high volume of failed authentication attempts (e.g., repeated 'Login failed' events) from a single external IP address targeting multiple user accounts within a short time window. This pattern is characteristic of a brute-force attack, where an attacker systematically tries password combinations to gain unauthorized access. The incident classification is based on the specific behavior of repeated login failures, not on malware signatures or traffic flooding.

In the Capability Maturity Model (CMM), Level 4 is 'Managed,' where processes are quantitatively measured and controlled using statistical and other quantitative techniques. This level focuses on using metrics to manage and adjust processes to achieve specific performance goals.

The most likely root cause is that risk treatment responsibilities and decision authorities are not clearly defined. Effective risk management requires that each risk has an owner who is accountable for treatment decisions, and that decision-making authority is established. Without this clarity, risks may be assessed but not acted upon, causing delays and leaving high-risk items unaddressed.

The percentage of risk treatment plans implemented as scheduled directly measures whether the governance process is translating risk decisions into action. Effective governance ensures that risk owners execute agreed-upon treatments within defined timelines, reflecting accountability and process adherence. This metric aligns with the CISM governance principle that oversight should focus on outcomes of risk management activities, not just operational metrics.

The core issue is that the vendor contract does not address nth-party (sub-supplier) risk, so the organization has no contractual leverage to require the vendor to manage its sub-suppliers. The best course of action is to revise the contract to include flow-down clauses that require the vendor to impose security requirements on its sub-suppliers, thereby extending the organization's security posture through the supply chain. This addresses the root cause—lack of contractual control—and is a preventive, governance-level action.

A transitional, risk-based governance approach lets the acquiring institution phase in critical security controls (e.g., identity, data protection, logging) while preserving the startup's agile practices in lower-risk areas. This balances the need for enterprise-wide risk alignment with the reality that abrupt policy imposition damages culture and velocity. It is the standard M&A security integration pattern recommended by ISACA and similar bodies.

The most important element of an exception management process is a documented remediation plan with timelines and formal risk acceptance. This ensures that the exception is temporary, that the risk is understood and accepted by the appropriate authority, and that there is a clear path to compliance.

Lessons learned aims to improve future response by identifying what worked and what didn't.

The Recovery phase (Phase 4) is most impacted when the backup server is encrypted during a ransomware incident. Without clean, unencrypted backups, the organization cannot restore systems and data to a known good state, which is the primary goal of the Recovery phase. The encryption of backups directly undermines the ability to recover, forcing the team to consider alternative recovery methods such as decryption keys, offline backups, or system rebuilds.