Exam CISM topic 1 question 179 discussion

Clearly its B and not C: How can you conduct reviews, if the information security objectives are not set? On what basis will you conduct regular reviews? None.

The most important function of an information security steering committee is to ensure that the information security strategy aligns with the broader corporate strategy, which involves defining the objectives of the information security framework (B).

I think it's C, the security team should primarily review and update the security framework. For the committee, they should focus more on the security business initiatives discussion.

State of security in the business and re-aligning as required

Defining objectives so B

C is the MOST important because it is the activity with highest level

Option C

IMO, it's C - Conducting regular independent reviews of the state of security in the business. Steering committee does the following: • ensures that security programs support the business objectives • evaluates and prioritizes the security programs • evaluates emerging risks, security practices, and compliance-related issues. In other words, they periodically check the state of security in the business, independently of infosec and IT.

The steering committee sets the direction and does not perform day to day. Therefore B is most appropriate

A. Evaluating the effectiveness of information security controls on a periodic basis The most important function of an information security steering committee is to ensure that the organization's information security controls are effective in protecting its assets and data. This involves regularly evaluating and assessing the state of security in the business to identify weaknesses, vulnerabilities, and areas for improvement. Without effective controls, the organization's information and assets are at risk, making it crucial for the committee to focus on this function. While the other options are also important aspects of information security management, evaluating control effectiveness is fundamental to maintaining a strong security posture.

Any idea whose responsiblity is this "C. Conducting regular independent reviews of the state of security in the business"

B. Defining the objectives of the information security framework