CISM Information Security Programme Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Comparing the proposed budget to industry benchmarks

  Why it's wrong here

  Industry benchmarks compare spending levels against peers, not the risk reduction or business value the programme delivers, so they cannot demonstrate value to this organisation. It is tempting because benchmarks are quantitative, but they would be correct when assessing whether the current security spend is proportionate to sector norms.

• ✓

  Calculating the ROI by estimating breach avoidance and compliance cost savings

  Why this is correct

  ROI expresses security spending in financial terms executives already use, quantifying avoided breach costs and compliance savings against the proposed increase. This satisfies the stem's requirement to demonstrate value, translating technical controls into business language the funding decision depends on.

• ✗

  Highlighting the number of security tools currently in use

  Why it's wrong here

  Counting deployed tools measures expenditure and complexity, not the value delivered; more tools can even indicate overlapping controls and rising cost. It is tempting because tool inventories are readily available, but this approach would be correct when justifying consolidation or identifying redundant licences in a cost-reduction exercise.

• ✗

  Listing all security certifications held by the team

  Why it's wrong here

  Team certifications evidence staff competence, not the security programme's contribution to reducing organisational risk or supporting business objectives. It is tempting because certifications are tangible and easy to present, but they would be the correct evidence when justifying training investment or demonstrating team capability to auditors.

Go deeper

Related to this question