CISSP Security and Risk Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  ISO/IEC 27001

  Why it's wrong here

  ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). While it ensures secure handling of information assets, its primary focus is on managing information security risks and controls across an organization, not on the lifecycle management of IT services themselves.

• ✗

  NIST Cybersecurity Framework

  Why it's wrong here

  The NIST Cybersecurity Framework provides a policy framework of computer security guidelines to help organizations manage and reduce cybersecurity risks. It outlines five core functions—Identify, Protect, Detect, Respond, and Recover—to improve an organization's ability to prevent, detect, and respond to cyber incidents, but it does not detail a service delivery lifecycle.

• ✗

  COBIT 2019

  Why it's wrong here

  COBIT 2019 is a comprehensive framework for enterprise IT governance and management, providing principles, processes, and organizational structures to align IT with business objectives. It focuses on value creation from IT, risk optimization, and resource optimization across the entire enterprise, rather than specifically detailing the lifecycle stages of individual IT services.

• ✓

  ITIL

  Why this is correct

  ITIL (Information Technology Infrastructure Library) is a widely adopted framework providing best practices for IT service management (ITSM). It specifically guides organizations through the entire service lifecycle, encompassing Service Strategy, Design, Transition, Operation, and Continual Service Improvement, making it ideal for managing the full journey of IT services.

Go deeper

Related to this question