Exam CISM topic 1 question 469 discussion

"new security issues associated with IT systems" If it said "security issues with new systems" i'd understand why it's D. But in this case we aren't really talking about making changes to a system, rather keeping an eye out for emerging threats to existing systems. This looks more like A to me... Anyone else have any thoughts?

D for me. Any potential security issues are identified and addressed as part of the routine process of making changes to IT systems and applications. Option A is important too, but may not be as timely since audits are typically conducted at set intervals and may miss issues that arise between audits.

Best approach to identify "NEW security issues" For example, CVE xxx regarding OS xxx ---> ISM learns new patches needed ---> Assessment --> then D. If A. periodic sec audits --> quarterly, semi annually, or yearly --> not a timely manner

Integrating risk assessments into the change management process will not Identify the security issues will prevent them.

My thinking is very close to AaronS1990's. Going with A on this one.

A. Requiring periodic security audits of IT systems and applications I agree with AaronS1990.. If this is happening periodically then it would have a better chance of identifying a security issue in a "timely manner". D. Integrating risk assessments into the change management process - While its a good thing there's no guarantee that there will be any changes applied thus initiating an assessment.

D. Integrating risk assessments into the change management process