Exam CISA topic 1 question 844 discussion

The scenario presented in the question highlights a gap in the organization's security threat and vulnerability management program. The ad hoc vulnerability scanning approach without clear alignment to the program could result in security vulnerabilities being overlooked or not addressed promptly, leaving the organization exposed to potential threats. The BEST option to address this issue is to implement a capability maturity model (CMM) to identify a path to an optimized program. A capability maturity model provides a framework to assess an organization's current level of maturity in a particular area and identify opportunities for improvement. In this case, a CMM for security threat and vulnerability management would enable the organization to evaluate its current practices and identify areas for improvement, leading to the development of a more robust and effective program