Certified Information Security Manager CISM (CISM) — Questions 526–600

The Communications Lead is responsible for notifying affected users about the phishing attack because this role manages external and internal communications, including user notifications, during an incident. In the exhibit, the Communications Lead is explicitly assigned the task of 'Notify affected users' under the communication plan, ensuring timely and accurate messaging to reduce further risk.

A risk-based approach aligns security investments with the organization's risk appetite, ensuring resources are directed to the most critical areas.

The security architect designs the security architecture, ensuring that security controls are integrated into systems and networks.

The alternate team must first assess the situation to understand the scope, impact, and validity of the ransomware attack before activating the plan. This aligns with the NIST SP 800-61 incident response lifecycle, where detection and analysis precede containment, eradication, and recovery. Jumping directly to execution without assessment could lead to inappropriate response actions, such as isolating systems that are not affected or failing to preserve critical forensic evidence.

The CIS Controls v8 framework is uniquely structured around Implementation Groups (IG1, IG2, IG3) to provide a prioritized, risk-based approach to security control implementation. IG1 represents basic cyber hygiene for organizations with limited resources, IG2 adds more advanced controls for those with moderate risk, and IG3 includes comprehensive controls for high-risk environments. This tiered structure directly aligns with the CISM focus on aligning security controls with business risk and resource constraints.

A unified data protection framework with regional adjustments allows the organization to maintain consistent governance principles while accommodating specific legal requirements of GDPR (e.g., data subject rights, 72-hour breach notification) and CCPA (e.g., opt-out rights, broader definition of personal information). This approach aligns with the CISM domain of Information Security Governance by enabling scalable, risk-based compliance without duplicating efforts or creating conflicts between policies.

A risk-based approach ensures that security spending is directed toward mitigating the risks that most threaten the institution's critical business objectives, such as protecting customer financial data or ensuring transaction integrity. By prioritizing initiatives based on assessed risk levels, the organization directly links security investments to business value, avoiding waste on low-priority controls.

C-suite executives need high-level strategic insights, not operational details. Top risks and key metrics (e.g., risk posture, critical incidents) are suitable for a dashboard.

Legal review ensures the policy complies with applicable laws and regulations before seeking approval.

The best metric for indicating a positive security culture is the number of security incidents reported. A high number of reported incidents demonstrates employee engagement, vigilance, and trust in the reporting process. This proactive behavior is a stronger indicator of a positive culture than metrics like phishing click rates, which primarily measure specific awareness effectiveness.

Defense-in-depth (option D) is the correct approach because it implements multiple, overlapping layers of security controls (e.g., firewalls, IDS/IPS, endpoint protection, access controls) so that if one layer fails or is bypassed, subsequent layers continue to provide protection. This layered strategy reduces the likelihood of a single point of failure compromising the entire security posture, aligning with the CISM principle of risk mitigation through redundancy.

Conducting a risk assessment (A) is the most important action because it directly evaluates the cloud ERP deployment against the organization's risk appetite, identifying, analyzing, and evaluating risks such as data exposure, vendor lock-in, and compliance gaps. This foundational step ensures that subsequent controls, contracts, and policies are aligned with the acceptable level of risk, as defined by the organization's risk tolerance thresholds.

Vulnerability management includes regular scanning and a prioritization process to remediate based on risk. Patching is part of remediation, but scanning and prioritization are foundational.

Mean time to respond (MTTR) directly measures how quickly incidents are contained and remediated.

The security architect designs and oversees the implementation of security architecture.

The COBIT framework (Control Objectives for Information and Related Technologies) is specifically designed to bridge the gap between IT governance and business goals, providing a comprehensive set of controls and processes that align security program objectives with enterprise strategy. Unlike other options, COBIT directly addresses governance, risk management, and performance measurement in a way that ensures the security program supports business objectives rather than operating in isolation.

The analyst must first validate the alert by reviewing additional logs (e.g., firewall, proxy, DNS, or endpoint logs) to confirm whether the SIEM alert represents a true positive. Jumping to containment or escalation without confirmation risks unnecessary disruption and false alarms, which violates the incident response principle of 'verify before acting.' The SIEM may have triggered on a benign pattern (e.g., a large file transfer to a trusted cloud service), and only correlated log analysis can establish intent and context.

Determining the scope of the incident (C) is essential during the detection and analysis phase because it defines the boundaries of the compromise—identifying which systems, data, and users are affected. This step is critical for prioritizing response actions and preventing the incident from spreading further. Without scope determination, subsequent containment and eradication efforts may be misdirected or incomplete.

Third-party contacts such as legal firms, forensic investigators, PR agencies, and insurance providers are essential for incident response. Internal contacts are separate.

Mean time to remediate critical vulnerabilities directly measures risk reduction, as faster remediation lowers exposure.

Senior leadership cares about financial impact. Breach cost avoidance and compliance cost avoidance directly demonstrate value by reducing potential losses.

Nth-party risk refers to risks from suppliers of your suppliers. Contractual requirements that cascade down the supply chain are essential to manage this risk.

Gap analysis identifies missing or inadequate controls before drafting new policies.

Restoring from an offline backup taken before the compromise ensures that the restored data is free of the ransomware and that the backup itself was not encrypted or tampered with. Since the attacker had administrative credentials, any online backup repository could have been accessed and compromised, making offline backups the only trustworthy source. This approach also eliminates the risk of re-infection by rebuilding the servers from scratch, ensuring no residual malware remains.

When residual risk exceeds the risk appetite threshold after planned controls, the security manager cannot simply accept or ignore it; the risk must be escalated to senior management because they hold the authority to decide whether to accept the risk, allocate additional budget for further controls, or adjust the risk appetite. This aligns with the CISM domain of Information Security Risk Management, where risk acceptance is a management decision, not an operational one.

In incident management, containment is the immediate priority after detection because it stops the spread of the threat and limits damage. Without containment, the attacker may continue to move laterally, exfiltrate data, or destroy evidence, making recovery and eradication ineffective. CISM emphasizes that containment must precede eradication and recovery to preserve forensic integrity and reduce business impact.

B is correct because the post-incident phase is the appropriate time to notify external stakeholders such as law enforcement, as it occurs after containment and eradication are complete. During this phase, the incident is fully documented, evidence is preserved, and legal obligations (e.g., breach notification laws like GDPR Article 33 or HIPAA Breach Notification Rule) are fulfilled. Notifying law enforcement earlier could compromise forensic integrity or operational continuity, so it is deliberately deferred to the post-incident stage.

Volatile data, such as the contents of system memory (RAM), is lost when the system is powered off. Collecting RAM first preserves evidence of running processes, network connections, and encryption keys that would otherwise be destroyed. This follows the order of volatility (RFC 3227), which mandates capturing the most volatile data first.

Centralized governance consolidates security resources and authority under one team, ensuring consistent policy enforcement and streamlined management.

Information security governance's primary objective is to ensure that security strategy is aligned with business goals, enabling the organization to protect assets while supporting its mission. This alignment is achieved through governance frameworks like COBIT or ISO 38500, which mandate that security investments and controls are directly tied to business objectives, not isolated technical measures.

The primary purpose of a security program's governance framework is to provide oversight and ensure that security activities are aligned with business objectives, risk appetite, and regulatory requirements. It establishes the policies, roles, and accountability structures that guide decision-making, rather than directly executing technical tasks. This alignment is critical for the program to be sustainable and supported by executive management.

Best practice for a mature security program is to allocate 10-15% of the IT budget to security. For a $10 million IT budget, that is $1 million to $1.5 million.

If the MTD is at risk, the incident response team should escalate to BC/DR to activate continuity or recovery plans. This ensures business functions are restored.

Training programs start with needs assessment, then content development, delivery, evaluation, and continuous improvement.

The CMT typically includes the CEO and CISO, among others, to make strategic decisions.

Monitoring regulatory changes, assessing impact, and updating controls are critical to maintaining compliance.

After a data breach, the incident response plan must prioritize clear, consistent communication to manage stakeholder expectations, regulatory notifications, and legal repercussions. Communication templates ensure that notifications to customers, regulators, and executives are accurate, timely, and compliant with breach notification laws (e.g., GDPR Article 33, state-specific 72-hour requirements). Without predefined templates, the response team risks delays or inconsistent messaging, which can exacerbate reputational damage and legal liability.

In the risk assessment process, the first step is to identify and classify information assets because you cannot assess risks to assets you haven't identified. For a cloud-based system storing sensitive customer data, this means cataloging data types (e.g., PII, financial records), their locations (e.g., specific cloud storage buckets), and their classification levels (e.g., confidential, restricted) before any threat or vulnerability analysis can be meaningfully performed.

Isolating affected endpoints preserves volatile memory evidence needed to analyze fileless malware.

A comprehensive risk assessment of the target company's environment identifies integration risks and informs the integration plan. Option A is premature without understanding risks. Option C and D are tactical steps that should follow risk assessment.

KPIs are designed to provide measurable evidence of how well the security program is achieving its objectives, specifically by quantifying the effectiveness of security controls. For example, a KPI like 'mean time to detect (MTTD)' directly measures the performance of detection controls, enabling data-driven decisions on control improvements. This aligns with the CISM focus on governance and performance management, not just compliance or budgeting.

Mean time to respond (MTTR) and security investment vs. loss avoidance are strategic metrics that inform risk management and resource allocation.

The most effective way to improve compliance is to align the policy with operational realities by involving business unit representatives in a policy review committee. When policies conflict with business processes, users will bypass them; adjusting the policy to be both secure and practical increases voluntary adherence. This addresses the root cause—policy misalignment—rather than treating symptoms like lack of awareness or enforcement.

The primary purpose of an information security risk assessment is to identify and evaluate risks in terms of their likelihood and impact. This process enables an organization to prioritize risks and determine appropriate risk treatment options, such as mitigation, transfer, acceptance, or avoidance, based on a clear understanding of the risk landscape. Without this evaluation, any subsequent risk management decisions would lack a defensible basis.

Merging two distinct security cultures requires a deliberate, collaborative approach that leverages the best practices from both organizations. Developing a new framework that incorporates strengths from both companies ensures buy-in from stakeholders and creates a unified governance structure that is tailored to the combined entity's risk profile, rather than imposing one side's culture or waiting for an uncertain natural convergence.

Board-level oversight and alignment with business objectives are foundational to governance, ensuring security is integrated into organizational strategy.

The primary goals of the containment phase are to limit the scope and impact of the incident (E) and prevent it from spreading to other systems (D). These actions aim to stop further damage and isolate affected resources. Eradication (B) is a separate phase, preserving evidence (C) is important but not a primary containment goal, and restoring normal operations (A) belongs to the recovery phase.

Compensating controls provide alternative protection when a primary control cannot be applied. Network segmentation limits the blast radius and reduces the attack surface until patching can occur.

Vulnerability management aims to identify, classify, and remediate vulnerabilities to reduce the attack surface.

Mean time to detect (MTTD) incidents is a direct measure of the security program's effectiveness in identifying threats, which demonstrates its value by showing how quickly the organization can respond to potential breaches. Metrics like budget percentage (A), patches applied (B), or policies created (C) are operational or input-focused and do not reflect the program's outcome or business impact.

The time to patch critical vulnerabilities directly measures the organization's exposure window to known exploits, which is a leading indicator of cybersecurity risk. A longer patch time increases the likelihood of a successful attack, making it a key risk indicator (KRI) for vulnerability management.

An automated response policy that approves blocking actions without human validation can trigger unnecessary disruption when false positives occur. Even if the severity threshold is appropriate, the lack of a verification step means legitimate traffic may be blocked, impacting business operations. The primary risk is not the effectiveness of the block but the operational impact of automated decisions on benign events.

The lifecycle begins with gap analysis to identify missing or outdated policies before drafting or approval.

The ACL shown only filters inbound traffic on the border router's external interface. Without an outbound ACL (or an inbound ACL on the internal interface), spoofed packets with internal source IP addresses can exit the network, enabling IP spoofing attacks that bypass anti-spoofing best practices (RFC 2827, BCP 38). This is a governance concern as it violates the principle of preventing source address spoofing, which is a fundamental security control for network perimeter defense.

Antivirus software detecting a known malware signature is the most reliable indicator because it uses signature-based detection, which matches file hashes or byte sequences against a known database of malicious code. This provides definitive, automated evidence of a security incident with minimal false positives, unlike subjective or ambiguous observations.

Phishing click rate is a leading indicator that measures user awareness and proactive security posture, while mean time to detect (MTTD) is a lagging indicator that reflects the efficiency of detection processes. Together, they provide a balanced view of program effectiveness for executive oversight.

After containment, the most critical step is identifying the root cause to understand how the incident occurred and to implement effective remediation measures. Without root cause analysis, the organization cannot ensure that the same vulnerability or attack vector will not be exploited again, making containment temporary at best. This aligns with the NIST SP 800-61 incident response lifecycle, which places eradication and recovery after containment, driven by root cause identification.

Roadmaps should be derived from business objectives to ensure relevance and executive support.

In a decentralized model, inconsistent security practices across business units can lead to gaps in protection and difficulty in enforcing enterprise-wide standards.

The provider's certifications and independent audits provide objective evidence of security controls, which is critical for trust.

Options A, B, and C are correct as they are common line items in an information security program budget. Incident response retainers cover external support for security incidents, security awareness training materials are essential for educating employees, and vulnerability assessment tools are used to identify weaknesses. Option D (marketing) is not a security cost, and Option E (employee salaries) is typically part of operational budgets, not the specific security program budget.

A harmonized control framework (e.g., ISO 27001, NIST CSF) maps common controls across multiple regulations (e.g., GDPR, PCI DSS, SOX), reducing duplication and conflict. This aligns with the board's limited risk appetite by providing a single, consistent set of controls that satisfy all requirements, avoiding the inefficiency and potential gaps of siloed approaches.

Industry information sharing groups (Option B) are a valid source of threat intelligence because they provide curated, actionable data on emerging threats, indicators of compromise (IOCs), and attack patterns from peer organizations. This intelligence is directly applicable during incident response to identify known adversary tactics, techniques, and procedures (TTPs) and to correlate findings with ongoing incidents.

Addressing root causes reduces reliance on exceptions and strengthens the security posture.

The policy requires documented exceptions for any access granted outside standard provisioning rules. The security manager observed that contractors had access without such documentation, which directly violates the governance requirement for maintaining an audit trail of approved exceptions. Without this documentation, the organization cannot demonstrate that access was properly authorized, creating a compliance gap.

For vendors handling sensitive customer data, the contract must include security requirements such as data protection clauses, incident notification timelines, and the right to audit. This ensures contractual enforceability of security controls.

Analyzing threats and vulnerabilities is a core step in the risk assessment process, as defined by the NIST SP 800-30 and ISO 31000 frameworks. This activity identifies potential threat sources and existing vulnerabilities that could be exploited, enabling the calculation of likelihood and impact for risk scenarios.