Free Preparation Discussions
MENU
Isaca CISM Exam Questions
- Topic 1: Information Security Management/ Identity Management
- Topic 2: Information Network Security Management Expectaions
- Topic 3: Information Security Governance
- Topic 4: InformationRisk Management
- Topic 5: Information Security Program
- Topic 6: Development and Management
- Topic 7: Information Security Incident Management
Free Isaca CISM Exam Actual Questions
Note: Premium Questions for CISM were last updated On Jun. 20, 2025 (see below)
An organization is implementing an information security governance framework. To communicate the program's effectiveness to stakeholders, it is MOST important to establish:
= Establishing metrics for each milestone is the best way to communicate the program's effectiveness to stakeholders, as it provides a clear and measurable way to track the progress, performance, and outcomes of the information security governance framework. Metrics are quantifiable indicators that can be used to evaluate the achievement of specific objectives, goals, or standards. Metrics can also help to demonstrate the value, benefits, and return on investment of the information security program, as well as to identify and address the gaps, issues, or risks. Metrics for each milestone should be aligned with the organization's strategy, vision, and mission, as well as with the expectations and needs of the stakeholders. Metrics for each milestone should also be SMART (specific, measurable, achievable, relevant, and time-bound), as well as consistent, reliable, and transparent.
The other options are not as important as establishing metrics for each milestone, as they do not provide a comprehensive and holistic way to communicate the program's effectiveness to stakeholders. A control self-assessment (CSA) process is a technique to involve the staff in assessing the design, implementation, and effectiveness of the information security controls. It can help to increase the awareness, ownership, and accountability of the staff, as well as to identify and mitigate the risks. However, a CSA process alone is not enough to communicate the program's effectiveness to stakeholders, as it does not measure the overall performance or maturity of the information security program. Automated reporting to stakeholders is a method to provide timely, accurate, and consistent information to the stakeholders about the status, results, and issues of the information security program. It can help to facilitate the communication, collaboration, and decision making among the stakeholders, as well as to ensure the compliance and transparency of the information security program. However, automated reporting alone is not enough to communicate the program's effectiveness to stakeholders, as it does not evaluate the achievement or impact of the information security program. A monitoring process for the security policy is a process to ensure that the security policy is implemented, enforced, and reviewed in accordance with the organization's objectives, standards, and regulations. It can help to maintain the relevance, adequacy, and effectiveness of the security policy, as well as to incorporate the feedback, changes, and improvements. However, a monitoring process alone is not enough to communicate the program's effectiveness to stakeholders, as it does not cover the other aspects of the information security program, such as governance, risk management, incident management, or business continuity.Reference=
CISM Review Manual, 16th Edition, ISACA, 2022, pp. 211-212, 215-216, 233-234, 237-238.
CISM Questions, Answers & Explanations Database, ISACA, 2022, QID 1018.
CISM domain 1: Information security governance [Updated 2022], Infosec,1.
Key Performance Indicators for Security Governance, Part 1, ISACA Journal, Volume 6, 2020,2.
Which of the following is the GREATEST concern resulting from the lack of severity criteria in incident classification?
Which of the following should be implemented to BEST reduce the likelihood of a security breach?
The PRIMARY reason to properly classify information assets is to determine:
Which type of backup BEST enables an organization to recover data after a ransomware attack?
Comprehensive and Detailed Step-by-Step Explanation:
Recovering from ransomware requires backups that are unaffected by the ransomware attack. Here's why offline backups are most effective:
A . Online backup: These are connected to the network and may also be compromised during an attack.
B . Incremental backup: While efficient, incremental backups rely on previous backups and are typically stored online, making them vulnerable to ransomware.
C . Differential backup: Similar to incremental backups, these are not immune if stored online or on compromised systems.
D . Offline backup: This is the BEST choice as offline backups are stored in a location that is not connected to the network, preventing ransomware from encrypting them.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Vinnie
2 days agoJackie
2 months agoArt
2 months agoLon
3 months agoCaprice
3 months agoNoah
4 months agoFernanda
4 months agoYong
4 months agoAshley
5 months agoBarrett
5 months agoDavida
5 months agoLauran
5 months agoLuis
5 months agoShaunna
6 months agoLaquita
6 months agoOlive
6 months agoLili
6 months agoBrittani
7 months agoJannette
7 months agoLeonor
7 months agoJohnetta
7 months agoDyan
7 months agoGlory
8 months agoLavera
8 months agoTroy
8 months agoFallon
8 months agoOllie
9 months agoStephanie
9 months agoArlen
9 months agoStephaine
9 months agoJunita
9 months agoBea
10 months agoMicah
11 months agoLavelle
11 months agoThurman
11 months agoAlline
12 months agoJerry
12 months agoChun
1 years ago