Exam CISM topic 1 question 1027 discussion

Answer is C: Risk assessment results. Because they offer a complete, context-driven foundation for defining security requirements that are relevant, justifiable, and aligned with organizational risk posture. Baseline controls are valuable and necessary, but they are not enough on their own to define the most comprehensive security requirements. A risk assessment ensures controls are justified, appropriate, and aligned to business needs

Full risk assessment is not comprehensive as it contains raw risks. Controls are baseline

Baseline controls are applied for a group of IT systems. Since the question is asking about the most comprehensive controls, I would go for C, since a risk assessment specifically addresses a systems risk.

A - Baseline controls represent the foundational security requirements that an organization establishes for its systems. These controls cover essential security aspects and serve as a starting point for securing the system. They include fundamental practices such as access controls, encryption, patch management, and configuration standards. C, is however, they focus on identifying and prioritizing risks rather than specifying detailed security requirements.

C. Risk assessment results

I would go with A stating baseline requirements for a newly developed information system as they don't require to be part of the system however analysis from the risk assessment results would be involved in the selection of baseline controls.

I would go with A

If risks are accepted without any need for additional controls, then the risk assessment itself doesn't result in new requirements. Baseline controls are a set of standard security requirements that apply to all systems within an organization to provide a minimum level of security.

The answer is C, key here is provide a foundation.

The most comprehensive set of security requirements for a newly developed information system would be defined by C. Risk assessment results. Risk assessment is a systematic process of identifying, analyzing, and evaluating potential risks to determine the effectiveness of existing security controls and identify any additional security requirements that may be necessary. By analyzing the results of a risk assessment, one can determine the specific security measures and controls needed to protect the information system effectively.

Risk assessment first, before developing Baseline controls. You cannot apply controls blindly without knowing what needs it

C. Risk assessment results is more comprehensive than A. Baseline controls

Baseline controls represent the most comprehensive set of security requirements for a newly developed information system. These controls provide a foundation of security measures that should be implemented regardless of the specific risks or vulnerabilities of the system. They cover a wide range of security aspects, including access control, data protection, network security, and application security.

C. Risk assessment results