CISM Information Security Programme Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Select all controls from NIST SP 800-53 without prioritization

  Why it's wrong here

  Defense-in-depth prioritises controls by risk and layering, so bulk-importing every NIST SP 800-53 control ignores likelihood and impact, leaving critical exposures unaddressed first. It tempts because SP 800-53 is a comprehensive catalogue; it would suit building a full baseline or compliance mapping, not initial prioritisation.

• ✗

  Deploy business-enabling controls that support operations

  Why it's wrong here

  Business-enabling controls support operations but do not reduce exposure first; defense-in-depth prioritises foundational protective controls before enablement. It is tempting because controls should not obstruct the business, yet that concern governs control design, not the initial prioritisation order, which starts with baseline safeguards protecting critical assets.

• ✗

  Implement compensating controls to address gaps in existing controls

  Why it's wrong here

  Compensating controls substitute for missing primary controls, so applying them before the baseline exists leaves the primary safeguard absent. It tempts because compensating controls are legitimate when a required control cannot be implemented; that scenario presupposes an established framework with identified gaps, not first-step prioritisation.

• ✓

  Prioritize critical controls that address the most significant risks

  Why this is correct

  Defense-in-depth prioritises controls by risk magnitude, so addressing the most significant risks first directs limited resources where exposure is greatest. This sequencing satisfies the stem's prioritisation constraint, ensuring foundational critical controls are implemented before lower-impact layers.

Go deeper

Related to this question