Isaca Certified Information Security Manager CISM Exam Questions

Answer : A

The greatest benefit of payment card data security standards is that they drive consistent, industry-wide protection of information assets (A). CISM governance emphasizes that standards such as those for payment cards establish minimum baselines that improve security maturity across the entire ecosystem. They do not eliminate attacks (B), optimize budgets (C), or directly enable new payment methods (D). Instead, they raise the overall level of protection, reduce systemic risk, and support trust in payment systems by ensuring consistent application of fundamental security controls.

Answer : D

When dealing with a provider in another country, the most important consideration is the ability to enforce contractual obligations (D). CISM highlights jurisdictional risk, including differences in laws, regulations, and legal enforcement mechanisms. Logical separation (A), SLAs (B), and resiliency (C) are important but depend on enforceable contracts to be meaningful. Without enforceability, the organization may lack effective recourse in the event of security failures or breaches.

Answer : D

Answer : A

Information security policies are high-level statements or rules that define the goals and objectives of information security in an organization, and provide the framework and direction for implementing and enforcing security controls and processes1.Information security policies should be aligned with the organization's business goals and objectives, and reflect the organization's risk appetite and tolerance2. Therefore, the most helpful activity for determining which information security policies should be implemented by an organization is a risk assessment.

A risk assessment is a systematic process of identifying, analyzing, and evaluating the risks that an organization faces, and determining the appropriate risk responses3. A risk assessment helps to determine the following aspects of information security policies:

The scope and applicability of the policies, based on the assets, threats, and vulnerabilities that affect the organization's security objectives and requirements.

The level and type of security controls and processes that are needed to mitigate the risks, based on the likelihood and impact of the risk scenarios and the cost-benefit analysis of the risk responses.

The roles and responsibilities of the stakeholders involved in the implementation and enforcement of the policies, based on the risk ownership and accountability.

The metrics and indicators that are used to measure and monitor the effectiveness and compliance of the policies, based on the risk appetite and tolerance.

The other options, such as a business impact analysis (BIA), a vulnerability assessment, or industry best practices, are not as helpful as a risk assessment for determining which information security policies should be implemented by an organization, because they have the following limitations:

A business impact analysis (BIA) is a process of identifying and evaluating the potential effects of disruptions or incidents on the organization's critical business functions and processes, and determining the recovery priorities and objectives. A BIA can help to support the risk assessment by providing information on the impact and criticality of the assets and processes, but it cannot identify or analyze the threats and vulnerabilities that pose risks to the organization, or determine the appropriate risk responses or controls.

A vulnerability assessment is a process of identifying and measuring the weaknesses or flaws in the organization's systems, networks, or applications that could be exploited by threat actors. A vulnerability assessment can help to support the risk assessment by providing information on the vulnerabilities and exposures that affect the organization's security posture, but it cannot identify or analyze the threats or likelihood that could exploit the vulnerabilities, or determine the appropriate risk responses or controls.

Industry best practices are the standards or guidelines that are widely accepted and followed by the information security community or the organization's industry sector, based on the experience and knowledge of the experts and practitioners. Industry best practices can help to inform and guide the development and implementation of information security policies, but they cannot replace or substitute the risk assessment, as they may not reflect the organization's specific context, needs, and objectives, or address the organization's unique risks and challenges.

References=1: CISM Review Manual 15th Edition, page 292: CISM Review Manual 15th Edition, page 303: CISM Review Manual 15th Edition, page 121 : CISM Review Manual 15th Edition, page 122 : CISM Review Manual 15th Edition, page 123 : CISM Review Manual 15th Edition, page 124 : CISM Review Manual 15th Edition, page 125 : CISM Review Manual 15th Edition, page 126

Answer : B

The correct answer is B because contractual agreements are the best mechanism for formally defining security requirements between an organization and a business partner. When information is shared externally, the organization must ensure that responsibilities for confidentiality, integrity, availability, privacy, access control, incident notification, audit rights, data retention, data return, and data destruction are clearly documented and enforceable. IT governance guidelines may provide general direction, but they are not usually legally binding. The business partner's own security policies may be useful during due diligence, but they do not necessarily reflect the organization's security requirements or risk appetite. Regulatory directives may define minimum legal obligations, especially for privacy protection, but they may not cover all organization-specific security needs. In CISM risk management, third-party relationships should be governed through due diligence, contracts, risk assessments, and ongoing monitoring. Therefore, contractual agreements provide the most appropriate and enforceable way to define security requirements for information sharing with a business partner.

Answer : C

Risk ownership should be assigned when the risk is identified (C). CISM emphasizes early assignment of ownership to ensure accountability for analysis, treatment decisions, and monitoring throughout the risk lifecycle. Waiting until treatment execution (A) delays accountability, while asset ownership (B) or vulnerability identification (D) alone does not ensure ownership of the broader business risk. Early ownership ensures risks are properly evaluated, escalated, and managed in line with risk appetite.

Answer : B

= The contact list is the most important element of the escalation procedures for an incident response plan, as it ensures that the appropriate stakeholders are notified and involved in the incident management process. A contact list should include the names, roles, responsibilities, phone numbers, email addresses, and backup contacts of the key personnel involved in the incident response, such as the incident response team, senior management, legal counsel, public relations, law enforcement, and external service providers.The contact list should be regularly updated and tested to ensure its accuracy and availability123.References=

1: Information Security Incident Response Escalation Guideline2, page 4

2: A Practical Approach to Incident Management Escalation1, section ''Step 2: Log the escalation and record the related incident problems that occurred''

3: Computer Security Incident Handling Guide4, page 18