ISACA CISM Exam Questions - Certified Information Security Manager

The greatest benefit of integrating information security governance into the corporate governance framework is the establishment of clear management accountability. Corporate governance is fundamentally about ensuring the organization is directed and controlled effectively, with the board and executive management being ultimately accountable for performance and compliance. By incorporating information security, it is elevated from a purely technical function to a critical business risk that leadership must own. This accountability ensures that information security receives the necessary strategic direction, resources, and oversight, aligning it with overall business objectives. The other listed benefits are positive outcomes that stem directly from this foundational accountability.

A. Heightened awareness is a secondary benefit that results from management taking accountability and driving security initiatives, not the primary benefit itself.

B. Improved process resiliency is an operational outcome of a well-resourced and managed security program, which is a consequence of governance, not the core benefit.

C. Promotion of security-by-design is a tactical approach. While supported by good governance, it is a specific implementation, not the overarching strategic benefit.

---

1. ISACA

CISM Review Manual

15th Edition. Domain 1: Information Security Governance

Task Statement G2

states a key task is to "Identify the legal

regulatory

organizational

and other requirements... to ensure accountability." The manual emphasizes that the ultimate responsibility for information security rests with senior leadership (the board of directors and executive management)

and governance is the mechanism to ensure this accountability is established and maintained.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The Governance domain

specifically EDM01 (Ensured Governance Framework Setting and Maintenance)

places the responsibility for governance on the board of directors. This objective ensures that "the governing body is accountable for the governance of enterprise I&T

" which includes information security. This establishes accountability at the highest level.

3. Turel

O.

& Bart

C. (2014). Board-level IT and information security governance: A review and directions for future research. Information & Management

51(2)

213-227. This academic review highlights that a key function of board-level involvement in IT/security governance is to establish clear accountability structures. The paper notes that board oversight (a form of accountability) is critical for aligning security strategy with business strategy and managing risk effectively. (https://doi.org/10.1016/j.im.2013.11.005)

A classification model is the foundational framework necessary for ensuring consistent protection of information assets. This model categorizes data and systems based on their level of criticality, value, and sensitivity to the organization. By establishing distinct classification levels (e.g., Public, Internal, Confidential, Restricted), an organization can then systematically and uniformly apply a corresponding set of security controls and handling procedures to all assets within a given category. This approach ensures that assets of similar importance receive a comparable and appropriate level of protection, thereby achieving consistency across the enterprise.

B. Control assessment: This is a process to evaluate the effectiveness of existing controls, not the foundational framework for their consistent application.

C. Data ownership: This establishes accountability for an asset but does not, in itself, provide the consistent methodology for how it should be protected.

D. Regulatory requirements: These apply specific protections to certain data types but often do not cover all organizational assets, thus failing to ensure comprehensive consistency.

1. ISACA

CISM Review Manual

15th Edition. Domain 2: Information Risk Management

Section 2.4

Information Asset Classification. The manual states

"Information classification is the foundation of an information security program because it is difficult to protect information assets without knowing their value... It provides the basis for handling requirements for information assets." This establishes classification as the fundamental element for applying protection.

2. Eloff

M. M.

& von Solms

S. H. (2000). Information security management: a hierarchical framework for various approaches. Computers & Security

19(3)

243-256. In their hierarchical framework

the authors place information classification at the policy level. They state

"The information classification policy should define the different levels of classification... and the required security controls for each level" (p. 247). This academic source links classification directly to the consistent application of controls. DOI: https://doi.org/10.1016/S0167-4048(00)03008-003008-0)

3. Stanford University

"Information Security Policy." (2023). Section 3.1

Data Classification. The university's policy illustrates this principle in practice: "Data must be classified into one of four categories... This classification determines the security protections that must be applied to the data." This demonstrates how a classification model is used in a reputable institution to ensure consistent protection.

The Recovery Time Objective (RTO) is fundamentally a business requirement that specifies the maximum tolerable duration of a service interruption. This requirement is derived directly from a Business Impact Analysis (BIA). The BIA's primary function is to identify critical business processes and quantify the adverse impacts (e.g., financial loss, reputational damage, regulatory penalties) that would result from their disruption over time. The RTO is set based on the point at which the impact of the service interruption becomes unacceptable to the organization. Therefore, understanding this impact is the greatest and most foundational consideration for determining the RTO.

B. Results of recovery testing are used to validate if a defined RTO can be achieved with current capabilities; they do not determine the RTO itself.

C. The Recovery Point Objective (RPO) is determined by the business's tolerance for data loss, which is a separate, though related, consideration from downtime tolerance (RTO).

D. Direction from senior management provides the final approval and resource commitment for the RTO, but this direction must be informed by the BIA's analysis of business impact.

1. ISACA

CISM Review Manual

15th Edition. Domain 3: Information Security Program Development and Management. The manual explains that the Business Impact Analysis (BIA) is the process used to "determine the impact of a disruption of business processes" and that its outputs

including RTO

are "used to make decisions about the business continuity strategy." This directly links the impact of interruption to the determination of the RTO.

2. Carnegie Mellon University

Software Engineering Institute. (2010). CERT Resilience Management Model (CERT-RMM) v1.0. (CMU/SEI-2010-TR-012). In the process area "Resilience Requirements Definition" (RRD)

Specific Goal 2 (SG 2) states

"Define the resilience requirements for high-value assets and their constituent services." The practice notes emphasize that these requirements

such as RTO

are derived from an analysis of the unacceptable impacts of service disruption.

3. Hiles

A. (2011). The Definitive Handbook of Business Continuity Management. John Wiley & Sons. Chapter 11

"Business Impact Analysis

" explicitly states that the BIA process is designed to gather data to quantify the impacts of a disruption over time. This data is then used to establish the Maximum Tolerable Period of Disruption (MTPD)

from which the RTO is derived as a target for recovery.

The absence of an assigned owner for a production database represents a critical failure in information governance. The information security manager's primary responsibility in this situation is to address the governance gap. The most effective and appropriate action is to report this finding to senior management. Senior management holds the ultimate responsibility for the organization's assets and possesses the authority to identify the appropriate business-level individual to assume ownership. This owner will then be accountable for classifying the data, defining protection requirements, and accepting residual risk.

A. Assign responsibility to the database administrator (DBA).

The DBA is a data custodian, responsible for the technical operation and maintenance of the database, not the data owner who is accountable for the information asset itself.

B. Review the databases for sensitive content.

While necessary for classification, this action is premature. A proper classification cannot be finalized and approved without an assigned owner to make business-driven decisions and accept accountability.

D. Assign the highest classification level to those databases.

This is a temporary risk mitigation measure, not a solution to the root problem. It does not resolve the fundamental governance issue of missing ownership and accountability.

1. ISACA

CISM Review Manual

15th ed.

2022. Domain 1

Section 1.2.3

"Information Security Roles and Responsibilities

" clearly distinguishes the role of the information owner (typically a manager or director responsible for the asset) from the custodian (e.g.

a DBA

responsible for technical controls). The manual emphasizes that the security manager's role includes reporting governance gaps to senior management for resolution.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives

2018. The governance process EDM01

"Ensured Governance Framework Setting and Maintenance

" states that a key practice is to "Direct the governance system

" which includes assigning responsibilities and ensuring accountability. A lack of asset owners is a direct failure of this governance process that must be escalated to the appropriate governing body (i.e.

senior management).

3. Tassabehji

R. (2005). Information Security Threats: From Perception to Reality. In Managing Information Assurance in Financial Services (pp. 47-85). IGI Global. This academic text on information assurance highlights that accountability is a cornerstone of security governance. It clarifies that accountability for information assets must reside with business management (owners)

who understand the value and context of the data

rather than with IT staff (custodians).

The ability to directly audit a service provider's IT systems and processes provides the highest and most specific level of assurance. An audit allows an organization to independently verify that its unique information security requirements, as stipulated in contracts and policies, are effectively implemented and operating as intended. This direct verification is more thorough than relying on demonstrations, self-attestations, or even compliance with generic standards, which may not fully align with the organization's specific risk appetite and control objectives. The "right to audit" is a critical contractual clause in third-party risk management.

A. A live demonstration can be easily staged or curated and may not accurately represent the continuous, day-to-day operational security posture.

C. A self-assessment is performed by the service provider themselves, which lacks the independence and objectivity of a third-party or customer audit.

D. An independent report (e.g., SOC 2, ISO 27001) attests to compliance with a standard framework, which may not cover all of the organization's specific requirements.

---

1. ISACA

CISM Review Manual

15th Edition. In the section on Third-Party Service Delivery Management

the manual states

"The right to audit the third party should be included in the contract to allow the organization to verify compliance with security requirements." This emphasizes direct audits as a primary mechanism for verification. (Domain 3: Information Security Program Development and Management

p. 158).

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The management practice APO10.04

"Monitor vendor performance and compliance

" includes the key activity: "Conduct reviews of vendor compliance with contractual requirements

including audits where appropriate." This positions direct audits as a key tool for monitoring and ensuring compliance. (APO10 Managed Vendors

p. 103).

3. Hall

M. A. (2017). Third party risk management: The new frontier of GRC. Journal of Business Continuity & Emergency Planning

10(4)

365-374. This academic publication discusses the evolution of third-party risk management

highlighting that robust due diligence and ongoing monitoring programs must include mechanisms for direct verification

such as on-site assessments and audits

to gain sufficient assurance beyond standard certifications. (pp. 370-371).

With DRaaS the organization pays only for the standby infrastructure and for actual fail-over time, avoiding capital expenditure for duplicate hardware, data-center space, power and cooling. Most DRaaS contracts are usage-based or subscription-based, so the recurring annual cost of disaster-recovery capability is typically far lower than running and maintaining an owned secondary site. Responsibility for recovery planning and testing still rests with management, and legal/operational risk cannot be fully transferred. Therefore the strongest business justification for selecting DRaaS is the significant reduction of continuing (annual) cost.

A. Accountability for continuity and regulatory compliance remains with the enterprise; only some operational tasks are outsourced, so risk is reduced, not transferred.

C. Removing a dedicated off-site facility is a contributor to, not the primary driver of, the cost reduction; some data or systems may still require on-premises storage.

D. Contractual services do not replace the need for periodic recovery testing; management must still verify RTO/RPO achievement.

1. ISACA

CISM Review Manual

15th ed.

Domain 4 “Business Continuity/DR”

pp. 303-305 – emphasises cloud DR cost advantages over owned alternate sites.

2. NIST SP 800-34 Rev.1

Contingency Planning Guide

§3.3.4 “Cloud-Based Recovery”

p. 45 – notes pay-as-you-go model lowers ongoing costs.

3. AWS Whitepaper “Disaster Recovery Options in the Cloud”

June 2022

p. 5 – identifies “lower cost” as the principal benefit of DRaaS.

4. IEEE Cloud Computing

Alshahrany & Walters

“Disaster Recovery as a Service: An Economic Perspective”

vol. 4 (2)

2017

pp. 58-59

doi:10.1109/MCC.2017.28 – quantitative analysis shows annual TCO savings of >40 % versus traditional off-site DR.

The initiation phase of the System Development Life Cycle (SDLC) is concerned with defining the purpose and scope of a new system. The primary information security activity at this foundational stage is to establish high-level security objectives. These objectives define the desired security posture by specifying the necessary levels of confidentiality, integrity, and availability required to support the business goals. This ensures that security is aligned with business needs from the outset and provides the basis for developing detailed security requirements and controls in subsequent SDLC phases.

A. baseline security controls: The selection of specific controls, even from a baseline, occurs during the design and development phases after requirements have been defined based on objectives.

B. benchmarking security metrics: This is an activity performed during the operations and maintenance phase to measure the effectiveness of security controls against established standards, not during project initiation.

D. cost-benefit analyses: While a high-level project cost-benefit analysis occurs during initiation, a detailed security-specific analysis is typically conducted later when evaluating specific control options to meet objectives.

1. National Institute of Standards and Technology (NIST). (2008). Special Publication (SP) 800-64 Rev. 2

Security Considerations in the System Development Life Cycle. Page 10

Section 2.1

"Initiation Phase

" states that a key security activity is to "determine the security category of the information system in accordance with FIPS 199." FIPS 199 involves categorizing systems based on the objectives for confidentiality

integrity

and availability.

2. National Institute of Standards and Technology (NIST). (2018). Special Publication (SP) 800-160 Vol. 1

Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems. Page 38

Section 3.2.2

emphasizes that the early stages of the life cycle involve defining stakeholder requirements

which include security objectives that drive the entire engineering process.

3. Wilson

M.

& Hash

J. (2003). NIST Special Publication (SP) 800-53

Building an Information Technology Security Awareness and Training Program. Page 2-1

Figure 2-1

"Security in the System Development Life Cycle

" shows that the "Initiation" phase involves "Needs Determination" and "Security Categorization

" which are foundational activities for setting security objectives.

When civil litigation is a goal, the primary concern is the admissibility and integrity of evidence in a court of law. The chain of custody is the chronological documentation showing the seizure, custody, control, transfer, analysis, and disposition of evidence. Establishing and meticulously documenting the chain of custody from the moment evidence is identified is the foundational step. Failure to do so can lead to the evidence being challenged and deemed inadmissible, which would undermine the entire legal proceeding. All other evidence collection and analysis activities are contingent upon this legally required process.

A. contact law enforcement.

This is appropriate for criminal matters, but civil litigation is a dispute between parties and does not necessarily involve a crime requiring law enforcement.

C. capture evidence using standard server-backup utilities.

Standard backup tools are not forensically sound as they can alter metadata (e.g., access times) and do not capture a complete bit-for-bit image, thereby contaminating evidence.

D. reboot affected machines in a secure area to search for evidence.

Rebooting a system destroys all volatile data in RAM, such as running processes and active network connections, which is often critical evidence for an investigation.

---

1. ISACA

CISM Review Manual

15th Edition. Domain 4: Information Security Incident Management

Section 4.5

Evidence Collection and Forensics. The manual states

"The chain of custody must be maintained for all potential evidence... If the chain of custody is broken at any point

the evidence may be rendered inadmissible in a court of law." (p. 238).

2. National Institute of Standards and Technology (NIST) Special Publication 800-86

Guide to Integrating Forensic Techniques into Incident Response. Section 3.3.2

"Chain of Custody

" explicitly states

"A complete chain of custody log is necessary for evidence to be admissible in a court of law. The log should contain information for each piece of evidence

such as item number

description

acquisition and disposition dates and times

and the individuals who handled the evidence." (p. 24).

3. Casey

E. (2011). Digital Evidence and Computer Crime: Forensic Science

Computers

and the Internet (3rd ed.). Academic Press. This is a foundational academic text in digital forensics. Chapter 3

"Legal Aspects of Digital Forensics

" emphasizes that "maintaining a proper chain of custody is essential for the evidence to be admissible in court... The chain of custody demonstrates that the evidence has not been altered or tampered with." (pp. 89-91).

The employees' use of unauthorized cloud storage indicates an unmet business requirement for accessible, shareable data storage. The most effective and strategic course of action is to first understand this underlying business need. By assessing why employees are using these services, the security manager can collaborate with business units to implement a sanctioned, secure, and managed solution that meets productivity demands while mitigating data leakage risks. This approach addresses the root cause of the issue and aligns the security program with business objectives, which is a core principle of information security governance.

A. Allowing a known risk to continue, even for monitoring, is a passive approach that fails to mitigate the immediate data exposure and potential compliance violations.

B. This is a reactive and punitive measure that disrupts productivity and fails to address the underlying business need that prompted the employees' actions.

C. A remote wipe is an extreme and disproportionate response for a policy violation on a personal BYOD device, creating significant legal and employee relations liabilities.

1. ISACA

CISM Review Manual

15th Edition

Chapter 3: Information Security Program Development and Management

Section 3.2.3. This section emphasizes the importance of integrating security requirements into organizational processes. The employees' actions signal a gap in business process support. The security manager's role is to understand this process and integrate a secure solution

rather than simply blocking the activity. This aligns security with business enablement.

2. ISACA

CISM Review Manual

15th Edition

Chapter 2: Information Risk Management

Section 2.5. This section covers Information Risk Response. The most appropriate risk response is one that effectively mitigates the risk while considering business objectives. Assessing the need (D) is the first step in formulating a risk mitigation strategy (e.g.

providing a secure alternative)

which is often more effective than risk avoidance (B) or acceptance (A).

3. ISACA White Paper

Guiding Principles for Cloud Computing Adoption and Use

2019

Page 8. The paper discusses the risk of "Shadow IT

" where business units or individuals procure IT services without explicit approval. The recommended guidance is not to simply block these services but to "establish a process to evaluate and approve cloud services" and "provide a catalog of approved services

" which directly supports assessing the business need to provide a secure

sanctioned solution.

The most critical element for ensuring continuity and effective management of an information security program during personnel changes is the existence of current, comprehensive documentation. When security personnel leave, they take their institutional knowledge with them. Well-documented processes, procedures, and configurations ensure this knowledge is retained by the organization. This allows for a smoother transition, enabling new or remaining staff to understand and execute required security tasks consistently, thus minimizing disruption and maintaining the organization's security posture. Documentation serves as the authoritative reference for program operations, independent of any single individual.

A. A formal strategy provides high-level direction but lacks the specific operational details needed to manage day-to-day tasks during a personnel transition.

B. An awareness program is targeted at the general workforce to reduce human error, not at managing the internal operations of the security team itself.

D. While establishing processes is vital, without documentation, these processes exist as "tribal knowledge" and are lost when the personnel who know them depart.

---

1. ISACA

CISM Review Manual

16th Edition. Domain 3: Information Security Program Development and Management

Task T3.5

emphasizes the need to "Establish and maintain information security processes and resources...". The associated knowledge statement K3.5.2

"Knowledge of methods to document information security controls

processes and procedures

" directly links the establishment of processes with their documentation to ensure they are repeatable

auditable

and resilient to changes in personnel.

2. NIST Special Publication 800-100

"Information Security Handbook: A Guide for Managers." Chapter 3

"Security Program Management

" Section 3.2

"Program Management Controls

" highlights that documented policies and procedures are essential for ensuring that security operations are performed in a consistent

repeatable

and effective manner

which is crucial for training new personnel and for operational continuity.

3. ISO/IEC 27001:2022

"Information security

cybersecurity and privacy protection — Information security management systems — Requirements." Clause 7.5

"Documented information

" mandates that an organization shall create

update

and control documented information required by the standard and necessary for the effectiveness of the information security management system (ISMS). This ensures the ISMS can operate consistently regardless of staff changes.