Exam CISM topic 1 question 349 discussion

I like A, but D is better - D. Identifying risks in the processes and managing those risks. So you will do a risk assessment on the process and manage the identified risks using controls, much better than A.

While all of the options contribute to ensuring compliance with information security policies, the most effective approach is: A. Ensuring that key controls are embedded in the processes By embedding key controls directly into IT processes, organizations can: Automate compliance: Many controls can be automated, reducing the risk of human error. Proactive enforcement: Controls can be designed to prevent non-compliant actions, rather than just detecting them after the fact. Continuous monitoring: Embedded controls can be monitored continuously to identify and address potential issues early on. While training, resource allocation, and risk management are important, they are more focused on preventing and mitigating risks rather than enforcing compliance directly. Embedding controls within the processes themselves provides a more proactive and effective approach to ensuring compliance.

Both A and D make sense. However, it asks for the most EFFECTIVE approach, which to me means more concrete measures. If you integrate controls in the process, you basically achieved assurance that it will all be done in compliance. D also sounds good, but it's more broad and too vague.

This is A. If you are trying to "ensure IT processes are performed in compliance" then if you embed the key controls in the process you have successful ensure compliance, it can not be deviated from. Therefore, answer A "Ensuring that key controls are embedded in the processes" is correct.

Its a VS D, but D makes more viable sense.

Should be D

A. Ensuring that key controls are embedded in the processes Embedding key controls directly into IT processes is a proactive and preventative approach to ensure compliance with information security policies. This means that security measures and requirements are integrated into the processes themselves, making it difficult for the processes to deviate from the established policies. By doing this, you reduce the likelihood of non-compliance and security breaches. While the other options (providing policy training, allocating resources, and identifying risks) are important, they are complementary measures and may not be as effective as embedding controls within the processes themselves.

The correct answer is A. Ensuring that key controls are embedded in the processes. Explanation: The most effective approach to ensure IT processes are performed in compliance with information security policies is to ensure that key controls are embedded in the processes. Here's why this option is the most effective: A. Ensuring that key controls are embedded in the processes: Embedding key controls directly into the IT processes ensures that security measures are integrated into the workflows. These controls align the processes with information security policies and guidelines, making adherence to security requirements a natural part of performing the processes.

I like A

Only A ensures compliance. D is just risk management

i vote A