Certified Information Security Manager CISM (CISM) — Questions 226–300

Root cause analysis should identify not only the technical cause but also the process and management failures that allowed the misconfiguration to occur.

It allows the incident response team to maintain necessary transparency with external partners while respecting legal counsel's directive to withhold sensitive details due to an ongoing law enforcement investigation. Providing a non-sensitive overview—such as the general nature of the incident, affected systems (without PII), and remediation timeline—fulfills partnership obligations without jeopardizing the investigation or violating chain-of-custody requirements for digital forensics.

The immediate priority is to contain the breach by isolating the compromised database server and blocking outbound traffic to the attacker's IP (6.6.6.6). This stops the exfiltration of cardholder data, preserves evidence on the isolated server, and minimizes business disruption by keeping the web application running. Shutting down servers (Option A) would cause unacceptable downtime, while patching (Option C) or imaging (Option D) without containment would allow continued data loss.

A centralized governance model consolidates security responsibilities under one team, ensuring consistent policy enforcement and resource allocation.

GDPR is the primary regulation for personal data protection in the EU.

Restore files from clean backups, as this is the most reliable recovery method after containment. Paying the ransom is discouraged and does not guarantee data recovery; notifying law enforcement can be done later; wiping and reimaging may be unnecessary if clean backups are available.

Leading indicators, such as the percentage of systems with known vulnerabilities patched within the SLA, provide early warning of potential issues. Patch compliance is a proactive measure that reduces risk.

When credentials are compromised in a phishing attack, the immediate priority is to contain the breach by invalidating the exposed credentials. Resetting the affected employees' passwords and enabling multi-factor authentication (MFA) prevents attackers from using the harvested credentials for unauthorized access, especially if the credentials are reused across other systems. This aligns with the Incident Response phase of containment before moving to eradication or recovery.

After implementing corrective controls, the next step in the risk management process is to perform a residual risk assessment. This evaluates the remaining risk after controls are applied, ensuring that the organization's risk appetite is not exceeded. Without this assessment, the organization cannot confirm whether the implemented controls are sufficient or if additional measures are needed.

Contractual security requirements (Option B) are essential because they legally bind the vendor to specific security controls, data protection obligations, and compliance standards. Without these enforceable clauses in the contract, the organization has no formal recourse if the vendor suffers a breach or fails to meet security expectations. This is a foundational element of any third-party risk management program, as it sets the baseline for acceptable risk transfer and due care.

Isolating infected workstations from the network is a primary containment action that prevents the malware from spreading laterally to other systems, limiting the scope of the incident. This is typically achieved by disconnecting network cables, disabling switch ports, or using network access control (NAC) to quarantine the affected hosts, which stops further propagation without destroying forensic evidence.

An incident response plan that has not been updated in two years is unlikely to account for recent changes in the threat landscape, such as new attack vectors (e.g., ransomware-as-a-service, zero-day exploits) or shifts in technology stack (e.g., cloud-native architectures, IoT devices). Without periodic review, the plan may lack updated playbooks for current malware families, fail to reference new detection tools, or omit revised containment procedures for modern network segmentation. This gap directly increases the risk of ineffective response during an actual incident.

Security champions are embedded in teams and receive specialized training, enabling them to advocate security practices.

CIS Controls v8 uses Implementation Groups to help organizations prioritize controls based on their maturity and risk.

Aligning security with business objectives ensures that security investments support business goals and demonstrate value to stakeholders.

Application whitelisting addresses the root cause: users disable HIPS due to false positives or performance issues with legitimate applications. By allowing only approved applications to run, HIPS can monitor without interference, reducing the need for users to disable it. This control maintains endpoint security while ensuring business-critical applications operate smoothly.

Defense-in-depth uses multiple layers of security controls. Network segmentation limits lateral movement, and endpoint detection provides visibility at the host level.

A governance committee with representatives from each facility establishes a federated governance model that aligns security practices across the hospital chain without restructuring teams. This approach enables consistent policy development, shared oversight, and coordination of patient data protection efforts while minimizing operational disruption, as each facility retains its existing team structure. It directly addresses the lack of central coordination and duplicate efforts by creating a collaborative decision-making body, which is a core principle of information security governance.

Qualitative risk assessment uses subjective ratings (e.g., high, medium, low) based on expert judgment to evaluate the likelihood and impact of risks. It is a common approach because it is quick to perform and does not require precise numerical data, making it suitable for initial risk prioritization in information security management.

A is correct because regular risk assessments are a foundational requirement of information security governance, as they ensure that security controls remain aligned with evolving threats and business objectives. Without periodic risk assessments, the organization cannot demonstrate due diligence or maintain an accurate risk profile, which is a direct indicator of governance failure.

A balanced dashboard should include both leading and lagging indicators to show current effectiveness and past outcomes.

Data access and service criticality are primary factors for tiering vendors.

Risk appetite must be aligned with the organization's strategic objectives and business goals, not dictated by external benchmarks or technology metrics alone. Facilitating a workshop with business leaders ensures that risk tolerance is mapped to strategic goals, which is a governance requirement under frameworks like COBIT and ISO 31000. This collaborative approach directly addresses the board's conflicting views by enabling informed, consensus-driven decision-making.

Implementing compensating controls, such as network segmentation, application-layer firewalls, or intrusion detection systems (IDS), directly reduces the residual risk of exploiting unpatched vulnerabilities in the legacy payment system without disrupting its critical daily operations. This aligns with the CISM principle that when a risk cannot be remediated (e.g., due to system criticality or vendor end-of-life), compensating controls are the primary treatment to bring risk within the organization's appetite.

The primary purpose of communicating risk assessment results to senior management is to provide the necessary information for informed decision-making regarding risk acceptance, transfer, or mitigation. Senior management holds the authority to accept residual risk based on a clear understanding of the potential impact and likelihood, which is a core tenet of the CISM framework for information security risk management.

Mapping controls to multiple regulations reduces duplication and ensures comprehensive coverage across requirements.

In the NIST SP 800-61 incident response lifecycle, the first phase is preparation, followed by detection and analysis. The spike in outbound traffic is an indicator of compromise (IoC), but before any containment or eradication steps, the analyst must confirm that the alert is a true positive—not a false positive caused by a legitimate application update, backup replication, or monitoring tool. This validation typically involves correlating the traffic with known baselines, checking source/destination IPs against threat intelligence feeds, and reviewing logs to rule out benign causes.

A formal process ensures that exceptions are documented, reviewed, and approved, reducing uncontrolled risk.

The Identification and Authentication (IA) family in NIST SP 800-53 covers user identification, authentication, and credential management.

Board-level metrics should focus on strategic impact, such as overall risk posture and financial implications.

The technical cause is the phishing email, the process failure is the lack of review of email filter configurations, and the management/governance failure is the absence of a change management process for security controls.

The primary purpose of an incident response plan is to establish a structured, systematic methodology for detecting, containing, eradicating, and recovering from security incidents. This ensures that the organization can minimize damage, reduce recovery time and costs, and preserve evidence for forensic analysis. Without a predefined plan, responses become ad hoc, increasing the likelihood of errors and extended downtime.

Preserving the chain of custody and ensuring forensic copies are made before remediation is critical for evidence admissibility. Legal hold ensures that relevant data is preserved.

A composite risk score aggregates threat, vulnerability, and control assessment data into a single metric that directly reflects the organization's residual risk posture. This metric is the most holistic indicator of program effectiveness because it quantifies how well security controls reduce the likelihood and impact of threats exploiting vulnerabilities, aligning with the CISM focus on risk management.

Value delivery is a core component of ISACA's COBIT framework for information security governance, as it ensures that security investments directly support business objectives and provide measurable benefits. COBIT defines value delivery as the process of optimizing security-related costs while maximizing the return on investment through effective risk management and resource allocation. This aligns with the governance objective of balancing value creation with risk mitigation.

The incident response plan must be reviewed and updated at least annually to ensure it remains effective against evolving threats and changes in the organization. Option B is correct. Vendor contracts (A), network topology diagrams (C), and user manuals (D) are typically reviewed on a different schedule or as needed, not necessarily annually.

Security policy and standards are foundational components of an information security governance framework because they establish the high-level direction, principles, and mandatory requirements that guide the organization's security posture. The risk management process is equally critical as it provides a structured methodology for identifying, assessing, and treating risks, ensuring that security decisions are aligned with business objectives and risk appetite. Together, they form the strategic and operational backbone of governance, enabling accountability and continuous improvement.

Level 3 (Defined) requires standardized, documented processes across the organization.

Compensating controls provide an alternative means of mitigating risk when the primary control is not feasible.

A formalized insider threat program with clear roles and responsibilities is the first governance improvement because it establishes a structured framework for detecting, preventing, and responding to insider threats. Unlike tactical controls, this program defines ownership, escalation paths, and policy integration, directly addressing the board's request for governance improvements rather than just technical fixes.

Business objectives and strategy (A) are foundational because the security program must align with and support the organization's mission, risk appetite, and strategic goals. Without this alignment, security controls may conflict with business operations or fail to prioritize critical assets, leading to wasted resources or increased risk exposure.

Rebuilding all affected systems from trusted backups ensures that any backdoors, rootkits, or persistence mechanisms left by the APT are completely removed. This approach is the most effective because APTs often deploy multiple, redundant backdoors that may not all be discovered through individual removal. Closing the attack vector first prevents re-infection during the rebuild process.

Nth-party risk refers to risks from suppliers of your suppliers, which can be overlooked.

A sustained downward trend in click rate over time indicates improved awareness and behavior, while single-click rate or reported emails may vary.

Defense-in-depth uses multiple layers of controls; here, network segmentation (preventive), IDS (detective), and incident response plan (corrective) cover different stages.

The incident involves unauthorized use of legitimate credentials to access a sensitive database, which is the defining characteristic of an account compromise. The immediate disabling of the account and remediation aligns with standard incident response procedures for credential theft, where the attacker has gained authenticated access without authorization. This is distinct from a data breach, which focuses on the exfiltration or exposure of data, not the method of access.

Enterprise security policy is high-level; domain-specific standards provide mandatory requirements for specific areas like remote access.

Risk reduction value and breach cost avoidance directly quantify the benefits.

Before any remediation, preserving evidence (forensic image) is critical for investigation and potential legal action. Then notify the incident manager to follow the playbook.

GDPR applies to any organization processing personal data of EU residents, regardless of location.

Role-based training targets specific risks relevant to each job function, making the training more practical and memorable.

The first step in developing a risk management program, per the CISM framework, is to conduct a risk assessment. This identifies the specific assets (e.g., client data on the file server), threats (e.g., ransomware), and vulnerabilities (e.g., lack of backups, weak access controls) that led to the incident. Without this foundational analysis, any subsequent controls—such as backups or insurance—would be misaligned with the firm's actual risk profile, potentially wasting resources on ineffective measures.

Compensating controls are essential to mitigate the risk of the exception, ensuring the organization's risk posture is acceptable.

The CIS Controls v8 are organized into three Implementation Groups (IG1, IG2, IG3) to guide organizations in prioritizing controls based on their risk profile and security maturity. NIST SP 800-53 and ISO 27001 use different categorizations.

Internal communication, especially to executives, is typically the first priority to ensure leadership is informed.

In a mature incident response program, regulatory compliance and data protection take precedence because financial institutions are subject to strict data privacy laws (e.g., GDPR, PCI DSS, SOX) that mandate safeguarding sensitive data during an incident. Allowing limited operations could lead to unauthorized data exposure or breach of legal obligations, resulting in severe penalties and reputational damage that outweigh the benefits of continued uptime.

Building an IRT starts with defining roles, then recruiting, developing procedures, acquiring tools, and testing.

Mature IAM includes lifecycle management (provisioning/de-provisioning), role-based access control (RBAC), and periodic access reviews to ensure least privilege.

The primary purpose of an information security program is to safeguard the confidentiality, integrity, and availability (CIA) of information assets. This aligns with the core definition of information security as defined in standards like ISO/IEC 27001 and NIST SP 800-53, which frame security controls around protecting these three attributes. A program must be risk-based and business-aligned, not just a collection of tools or compliance checklists.

The IR team includes security analysts, forensic investigators, and legal counsel; the CMT includes executives like CEO; HR is not a standard IR role.

A mature security program with documented policies and standards indicates that the classification rules are already defined. The audit finding that business units are not following the mandated standard points to a failure in enforcement mechanisms—such as automated Data Loss Prevention (DLP) rules, access control policies, or mandatory labeling in SharePoint—rather than a lack of awareness or outdated policy. Without enforcement (e.g., Group Policy Objects blocking unclassified data uploads or SIEM alerts for missing classification tags), even well-trained staff may bypass the standard.

The CMT includes senior executives like CEO, CFO, CISO, GC, and Communications; a security analyst is part of the incident response team, not the CMT.

Key risk management terms from CISM: Risk is the effect of uncertainty on objectives; controls are measures that modify risk; vulnerabilities are weaknesses that can be exploited; threats are potential causes of incidents. The distractor pairs swap risk with threat and control with vulnerability.

Continuous data protection (CDP) with frequent snapshots captures every write operation in near real-time, allowing recovery to any point before the ransomware encryption. This eliminates the gap between the last backup and the attack, ensuring that even files modified after the last full backup can be restored without data loss.

Parameterized queries (prepared statements) and input validation directly address the root cause of SQL injection by separating SQL logic from user-supplied data. This is a remediation (mitigation) strategy that reduces the likelihood of exploitation to an acceptable level, which aligns with the high-risk scenario described.

Residual risk is defined in information security risk management as the risk that remains after management has implemented all planned controls. This concept is central to the CISM framework because it represents the exposure that must be accepted, transferred, or further mitigated by the organization. Unlike inherent risk (before controls), residual risk accounts for the effectiveness of the security measures in place.

Leading indicators predict future performance; phishing click rate and patch compliance are proactive measures.

The Recovery Time Objective (RTO) defines the maximum acceptable downtime after a disaster or incident, which directly aligns with the requirement to restore critical transaction systems within 4 hours. In incident management, RTO is the metric used to set the target for system recovery, ensuring business continuity. For ransomware incidents, RTO drives the restoration strategy and resource allocation to meet the 4-hour window.