Certified Information Security Manager CISM (CISM) — Questions 226–300

An incident response playbook delivers the step-by-step technical instructions the stem demands, mapping specific containment, eradication and recovery actions to a defined incident type. Unlike broader plans or procedures, it prescribes exact commands and decision points, so responders execute consistent, repeatable actions under pressure.

Defining risk appetite and tolerance and embedding them into decision processes directly ensures that every security decision is evaluated against the board's risk preferences. This creates consistency and traceability, allowing the board to verify that security activities remain within agreed boundaries. It is the foundational step that enables other governance mechanisms, such as committees and metrics, to function effectively.

Patch compliance percentage measures activity performed before incidents occur, revealing whether vulnerability remediation is keeping pace. Unlike breach counts or incident volumes, which are lagging, it predicts future exposure, making it a leading indicator of security performance.

Undocumented policies and a divergent risk culture mean the acquirer cannot reliably assess what exposures it is inheriting. Rapid integration without due diligence effectively transfers unknown high-risk exposures onto the acquiring company's balance sheet and governance accountability.

An executive steering committee gives senior management direct ownership of the security programme, satisfying the accountability requirement. Cross-functional representation from business units, legal and IT ensures security decisions align with business objectives rather than remaining an isolated technical function.

ISO 27005 sequences risk identification before risk analysis. Having identified the vulnerability, the organisation must next estimate the likelihood of exploitation and the resulting impact, which produces the risk level used for subsequent evaluation and treatment decisions.

Best practise targets the systemic layer: why the misconfiguration occurred and why change management failed to catch it. Fixing only the firewall setting leaves the governance weakness intact, so the same class of error recurs.

Providing only a non-sensitive overview satisfies legal counsel's confidentiality constraint while preserving partner awareness. This partial-disclosure approach shares sanitised indicators without revealing law-enforcement-sensitive details, balancing transparency with the investigation's integrity. It avoids full disclosure that could compromise the probe, and avoids total silence that would breach partner obligations.

An independent audit report, such as SOC 2 Type II, provides validated evidence that the provider's controls operated effectively over a period. It covers security, availability, and confidentiality criteria and is issued by a third-party auditor. This gives the organization reliable assurance for risk assessment and vendor management, far more than self-attestations or marketing claims.

Containment precedes eradication: isolating the database server and blocking outbound traffic to 6.6.6.6 halts the active exfiltration, satisfying the 72-hour cardholder-data reporting obligation while preserving the web tier for customers. Forensic imaging and legal notification follow once data loss is stopped.

A centralized structure places decision-making authority and the security function within one team serving the whole organisation, directly matching the stem's single-team constraint. This contrasts with decentralized models, where security personnel report into separate business units, and federated hybrids, which distribute control while retaining a coordinating function.

GDPR is the EU regulation that imposes data protection obligations on organisations processing personal data of EU citizens, mandating technical and organisational safeguards. It directly satisfies the stem's requirement for a regulatory mandate covering EU citizen data.

Severity levels are defined in advance against business impact criteria, so the on-call responder can classify an event consistently within minutes and trigger the agreed escalation path. This removes subjective judgement during the most chaotic phase of an incident and ensures the crisis management team is invoked only when the documented thresholds are met.

Restoring from clean backups directly satisfies the recovery objective after containment, reinstating encrypted file server data with verified integrity. Backups predating the ransomware's encryption window avoid reintroducing the payload, unlike decryption attempts or paying ransoms. This restores availability, the CIA triad pillar compromised by the attack, before returning to normal operations.

Patch SLA compliance measures current remediation performance, so low compliance predicts unpatched exploitable systems and therefore future incidents. It is a leading indicator because it reflects exposure accumulating now, unlike lagging counts of incidents already suffered.

A gap assessment maps existing controls to regulatory requirements and prioritizes remediation by risk, showing executives exactly where exposure exists and how it will be addressed. This aligns security investment with compliance obligations and provides a defensible, measurable plan. It demonstrates that the program is driven by both regulatory need and business risk rather than by technology preferences.

After corrective controls are implemented, a residual risk assessment determines what risk remains, confirming whether treatment reduced exposure to an acceptable level or whether further action, transfer or acceptance is required before closing the change management gap.

TLS encryption for data in transit directly closes the identified HIPAA gap, protecting ePHI as it crosses the internet between endpoints. It is the specific technical safeguard addressing the audit finding, and is prioritised because unencrypted transmission is an active, ongoing breach exposure.

Quantitative risk assessment uses numerical data, such as monetary values and probabilities, to calculate expected losses. This provides an objective and consistent basis for comparing risks across business units. Senior management can use metrics like annualized loss expectancy (ALE) to prioritize investments. While quantitative methods require more data and effort, they meet the requirement for objectivity and comparability better than qualitative scales.

A new risk assessment is the foundational step to identify and evaluate risks introduced by cloud services, telehealth, and regulatory changes. It provides the basis for updating security controls and strategies. Without a current risk assessment, any control adjustments would be based on outdated assumptions, potentially leaving critical gaps. CISM emphasizes that risk assessment should be ongoing and triggered by significant changes.

Sinkholing command-and-control and confirming that no hosts continue to beacon provides concrete evidence that the adversary has lost remote control of compromised systems. This is a strong, observable containment indicator because active implants would keep attempting to reach their infrastructure. It directly demonstrates that the attacker's ability to operate within the environment has been disrupted.

Containment always involves trade-offs: taking systems offline stops the attacker but may disrupt revenue, while leaving them online preserves service but allows further damage. The incident commander must balance these competing risks using business impact analysis and current threat intelligence. This risk-based judgment, aligned with organizational priorities, is the primary guide. Neither technical feasibility alone nor cost alone captures the full decision, which is fundamentally about acceptable risk.

Contracts embed enforceable security obligations, breach notification duties, audit rights and liability into the vendor relationship. This gives the organisation legal leverage when a third party's controls fail, satisfying the governance requirement that risk be formally transferred and managed.

A mandatory global baseline with CISO-approved exceptions closes the loophole regional staff exploited, since deviations require central sign-off rather than local self-assessment. It preserves operational flexibility through the formal exception route while enforcing the control the breach exposed as missing.

Isolation stops lateral movement.

RAM contains highly volatile data such as running processes, network connections, and encryption keys, which are lost when the system is powered off. Collecting RAM first is critical to preserve this evidence. This follows the order of volatility, a fundamental concept in digital forensics. Failing to capture RAM first could result in loss of crucial evidence for the investigation.

Threats, attack techniques and the underlying technology estate evolve continuously, so a two-year-old plan likely omits current attack vectors and no longer maps to the present environment, leaving response procedures misaligned with what the organisation now operates.

Champions functioning as liaisons create a bidirectional channel, translating security requirements into team language and surfacing development constraints to security. This embedded communication satisfies the programme's effectiveness criterion by removing the bottleneck of a central security team.

Network isolation via EDR contains the threat by cutting command-and-control and lateral movement paths while preserving volatile memory and running processes for forensic analysis. This balances the twin CISM goals of limiting business impact and maintaining evidence integrity, allowing investigators to collect memory, logs, and network state before any destructive action. It is the least disruptive containment step that still stops the attack from spreading to the payment card environment.

Isolating network segments can halt the attacker's lateral movement but may also disrupt critical business services, customer-facing systems, and revenue-generating operations. The incident response manager must weigh the security benefit of containment against the business impact, which is a core CISM principle. This decision requires understanding which systems are critical and what tolerances exist for downtime, ensuring the response aligns with organizational risk appetite.

CIS Controls v8 uniquely structures its safeguards into Implementation Groups IG1, IG2 and IG3, mapped to organisational risk profile and available resources. No other framework uses this tiered grouping, directly satisfying the stem's stated constraint.

Segmenting the network into zones with controlled inter-zone traffic limits lateral movement, so compromise of one system cannot reach critical financial systems directly. This enforces least-privilege connectivity, a core defense-in-depth layer satisfying the stem's requirement to isolate critical systems.

This is correct because external communications during an incident must comply with laws, regulations, and contracts. For example, data breach notification laws require timely notification to affected parties and regulators. CISM emphasizes that incident response must align with legal and regulatory obligations. This is the primary consideration because failure to comply can result in fines and legal action.

Subtracting the $300,000 annual control cost from the $2,000,000 in loss reduction ($2,400,000 ALE minus $400,000 residual ALE) yields a net benefit of $1,700,000 per year. This cost-benefit figure directly demonstrates that the investment produces a positive return, which is the clearest financial justification for the executive committee.

Escalation to the crisis management team exists to mobilize executive decision-making, communications, and resource authority when business objectives or critical services are threatened. Defining thresholds in terms of business impact aligns incident severity with the organization's risk appetite and ensures leadership engages when strategic decisions, regulatory notifications, or customer commitments are at stake.

A governance committee with facility representatives establishes federated decision-making, letting each security team retain local control while aligning policies and eliminating duplicated effort. This directly satisfies the CISO's constraints of minimal disruption and no central coordination, since authority is shared rather than imposed, and inconsistent patient data protection is resolved through agreed, cross-facility standards.

Qualitative assessment ranks risks using descriptive scales such as high, medium and low, drawing on expert judgement rather than numeric values. It satisfies the stem by being one of the two recognised risk assessment approaches, suiting scenarios where precise monetary estimates are impractical.

Regular risk assessments are fundamental to governance to ensure risk is managed.

A risk aggregation model quantifies cumulative impact across correlated low-likelihood, low-impact risks, exposing the combined exposure that siloed assessments miss. Enterprise-level controls then address that aggregate exposure, satisfying the stem's requirement to manage risks whose significance emerges only collectively rather than individually.

This is correct because CISM defines risk appetite as the amount of risk an organization is willing to accept. By defining appetite and tolerance, and monitoring key risk indicators (KRIs), the CISO can demonstrate that risks are being kept within those bounds. This is an ongoing governance activity that provides the board with assurance that risk management is proactive and aligned with business objectives.

Legal counsel holds authority over what may be disclosed publicly and what must be reported to regulators, balancing statutory obligations, privilege, and liability. Public statements and regulatory notifications carry legal consequences, so the incident manager must route these decisions through legal. Counsel also determines whether attorney-client privilege should be invoked to protect investigation details from later discovery.

Assigning corrective actions with clear owners and due dates converts findings into accountable, trackable improvements. Without ownership and deadlines, lessons learned remain observations rather than changes. This step ensures the post-incident review produces measurable risk reduction and closes the loop on identified weaknesses, which is essential for continuous improvement of the incident response program.

The type and sensitivity of data a vendor accesses directly determines the potential impact of a breach, making it a primary tiering factor. This satisfies the stem's requirement by tying risk tier to data criticality rather than contract value or vendor size.

The current annualized loss expectancy is 0.04 × $4,000,000 = $160,000, and after the project it is 0.01 × $4,000,000 = $40,000, giving an expected annual risk reduction of $120,000. Because the $900,000 project cost exceeds a single year's benefit, the manager must weigh multi-year benefit, risk appetite, regulatory requirements, and non-quantifiable impacts before recommending the investment. This is a sound risk-treatment analysis.

Mapping risk tolerance to strategic goals translates the board's conflicting abstract views into concrete, business-aligned thresholds, producing the formal risk appetite statement the regulator mandates. A workshop with business leaders secures the ownership and consensus that a purely security-driven definition would lack.

Compensating controls directly address the unpatched vulnerabilities without requiring remediation the legacy system cannot support, reducing likelihood while preserving daily payment operations. Because the system is critical and cannot be patched, mitigation through alternative safeguards satisfies the risk-reduction requirement better than avoidance, transfer, or acceptance.

Risk assessment results give senior management the likelihood and business impact figures needed to decide whether to accept, transfer, mitigate or avoid each risk. Communication therefore exists to support informed risk acceptance decisions at the level holding accountability for organisational risk.

Mapping common controls to multiple regulations lets one control satisfy overlapping GDPR, CCPA and PCI DSS requirements, eliminating duplicate evidence collection and testing. This satisfies the efficiency constraint by reducing assessment effort while maintaining demonstrable compliance across all three frameworks.

A formally approved charter establishes the security programme's mandate, authority, and scope, and is the foundational governance artifact that ties security activity to board-level oversight and business objectives. Without an approved charter, subsequent policies, metrics, and reporting lack legitimacy and authority. This aligns with CISM's emphasis on establishing governance before executing controls or measurement.

Confirming the incident as a true positive validates that the outbound traffic spike is genuinely malicious rather than benign, such as a backup or replication job. This satisfies the first-step requirement by preventing wasted response effort before containment or eradication actions are initiated.

The immediate priority on confirming active malicious communication is to stop the spread and cut the attacker's control channel. Isolating the terminal halts data exfiltration and lateral movement while keeping the device's state intact for forensic examination. Preserving evidence alongside containment ensures the organization can still determine scope and root cause. This balanced first step protects the business without destroying the information needed to understand the intrusion.

A risk appetite statement, approved by senior management, is essential because it sets the boundaries for risk-taking and guides security decisions. It ensures that security activities align with business objectives and provides a basis for measuring whether risks are acceptable. Without it, governance lacks direction and accountability.

Order of volatility dictates that memory contents, running processes, network connections, and encryption keys are lost on shutdown or reboot. Capturing a forensic image of both RAM and disk preserves the most perishable evidence first, maintaining the chain of custody and enabling later analysis. Without this step, critical artifacts such as active sessions and injected code may be permanently destroyed before remediation begins.

The gap is governance, not technology. Someone must hold pre-delegated authority to make high-impact calls such as taking production offline, and that authority must be documented and endorsed by executives so it is recognized during a crisis. A clear escalation path also tells responders whom to wake at 3 a.m. and who owns the final call when business and security priorities conflict.

A formal exception process routes every deviation through the same assessment, approval and documentation steps, so risk is knowingly accepted by the appropriate authority rather than absorbed silently. This consistency and traceable risk acceptance is the primary benefit the stem asks for.

NIST SP 800-53's Identification and Authentication (IA) family directly governs user identity verification and credential management, satisfying the stem's requirement for the control family addressing user identification and authentication. IA controls cover authenticator management, identity proofing and session authentication, making it the precise match rather than access control or audit families.

MTTD and MTTR measure how quickly the security programme detects and contains incidents, translating technical operations into resilience outcomes. These satisfy the board-level reporting constraint by conveying programme effectiveness in business-relevant terms rather than raw alert volumes.

The root cause is a governance gap: no change management process governed security control configuration changes, so the email filter misconfiguration went unreviewed. Documenting this management failure addresses the underlying control weakness rather than the phishing symptom.

An incident response plan defines the structured, repeatable phases — preparation, detection, containment, eradication, recovery and lessons learned — that guide responders. This systematic method reduces confusion and ad hoc decisions during incidents, which is its primary purpose.

Issuing a legal hold preserves potentially relevant data and suspends routine deletion, while forensic copies capture the affected systems' state before remediation alters or destroys artefacts. This satisfies the admissibility constraint by maintaining an unbroken chain of custody and preserving original evidence for legal proceedings.

A shared taxonomy and calibrated scales ensure that a 'high likelihood' means the same thing in the finance unit as in the plant operations unit, making assessments comparable across the enterprise and allowing aggregation into an organizational risk profile. Without this consistency, ratings from different units cannot be meaningfully combined or trended.

A composite risk score aggregates threat, vulnerability and control assessments into a single weighted measure, so it reflects residual risk reduction across the whole programme. Individual metrics such as patch compliance or incident counts capture only one dimension and cannot demonstrate overall effectiveness.

A gap analysis is the logical first step because it identifies where the current program falls short of the legal requirements. Without understanding the gaps, the CISO cannot prioritize investments, assign resources or develop a credible compliance roadmap. The analysis provides the factual basis for all subsequent decisions, ensuring that remediation efforts target actual deficiencies rather than assumptions.

The incident response plan documents contacts, roles, escalation paths and procedures that change as systems, personnel and threats evolve. Annual review satisfies the stem's requirement by keeping response actions current and validated, ensuring the plan remains executable during a live incident.

Security policy and standards translate management's risk appetite into enforceable directives, defining acceptable use, control baselines and accountability. They are the foundational governance artefacts that direct and constrain security activity, satisfying the framework's requirement for documented direction and measurable compliance criteria.

Notification duties vary by jurisdiction in scope, timing, and recipients, so legal expertise is essential to map them accurately. Issuing notices progressively as facts are confirmed satisfies statutory deadlines while avoiding premature or inaccurate disclosures. This approach balances regulatory compliance, customer transparency, and the practical reality that breach investigations evolve over time.

Tuning SIEM rules to eliminate known false positives reduces alert volume so genuine detections, such as the missed lateral movement alert, are no longer buried. This directly addresses the root cause of analyst fatigue and satisfies the primary improvement requirement, restoring trust in the monitoring capability.

CMM Level 3 requires defined, organisation-wide standardised processes, not the ad hoc or per-project approaches of Levels 1 and 2. Documented security processes applied consistently across the enterprise satisfy this definition, evidencing the institutionalisation the stem's maturity goal demands.

Data classification identifies which records fall under each jurisdiction's data protection laws, and role-based access controls enforce least privilege across those categories. This satisfies the low-residual-risk appetite by limiting exposure of regulated personal data held in the multinational CRM.

Indicates program reach.

A formalised insider threat programme establishes accountable ownership, defined roles and repeatable detection, response and monitoring processes. This directly addresses the governance gap exposed by the breach, giving the board assurance that insider risk is now managed rather than ad hoc.

The information security policy is a high-level document that defines the organization's overall security direction, objectives, and responsibilities. It is typically approved by senior management and serves as the foundation for all other security documents, making it the correct choice for the committee's expectation.

Translating security risk into business impact, such as revenue loss, regulatory penalty, or service disruption, and recording it on the enterprise's common scales allows ERM to compare and aggregate it with other risk types. This integration supports enterprise prioritization and gives executives a coherent view of total risk exposure.

Rebuilding from trusted backups eliminates all persistent backdoor artefacts, including hidden accounts and modified binaries, that malware removal alone cannot guarantee. Closing the attack vector first prevents immediate reinfection during restoration, satisfying the requirement to fully eradicate an APT's multiple footholds rather than partially remediate them.

Click rate trend across successive simulation cycles reveals whether user behaviour genuinely improves over time, rather than reflecting a single campaign's snapshot. A sustained downward trend evidences durable learning, whereas one-off completion or report counts can be inflated by transient awareness or repeat reporting.