Exam CISM topic 1 question 3 discussion

Clearly it is B, how do you gain a clear understanding of the impact of new regulations: perform a risk assessment. If the question was: What is the first step on getting compliant? Then a gap analysis would be correct. But not in this case.

This has to be B. A risk assessment will identify any risks with adopting new policies and technologies. A gap analysis is a method of assessing the performance of a business unit to determine whether business requirements or objectives are being met and, if not, what steps should be taken to meet them.

Gap Analysis: By identifying the gaps between current controls and the new regulatory requirements, the manager can assess what changes or additional measures are necessary. This analysis provides a foundation for any subsequent risk assessment or control adjustments.

the answer remains D. Perform a gap analysis because it’s the initial diagnostic step to understand the controls required for compliance. After the gaps are known, risk assessments can better evaluate the consequences of those gaps.

Two references from ISACA REVIEW MANUAL support B, Risk Assessment, as the right answer: 1. Page 32. last paragraph states that "regulatory compliance should be treated as any other risk". 2. Page 152 Figure 3.1, shows that Risk Management informs Current State which is in turn used in gap analysis. When there is a new regulatory requirement, one should conduct a risk assessment first to determine the IMPACT (RISK) OF NONCOMPLIANCE. Risk assessment will DETERMINE IF THE RISK OF NON-COMPLIANCE IS WITHIN ACCEPTABLE LEVELS. If the risk is above acceptable levels, then it makes sense to conduct a gap analysis to understand the existing control effectiveness and identify additional/compensatory controls that will be required for compliance.

3 arguments why I would choose B: 1. "understanding the impact" as in the question itself relates to risk assessment. 2. introduction of compliance is a "change", that a security manager should treat as a trigger for risk assessment 3. Once risk assessment suggests required controls (mitigation strategy), we do gap analysis to identify current controls and controls required in future, to draw the ways/actions to achieve the future controls

Once the risks are assessed and understood, the organization can then proceed to make informed decisions about whether to implement additional controls, modify existing ones, or accept the risk. Afterward, a cost-benefit analysis, interviews with senior management, and gap analysis can be conducted to further refine the approach and ensure compliance with the regulatory requirement while considering the organization's overall objectives and constraints.

page 123: If its found that the enterprise is noncompliant, then the regulations must be evaluated to determine the level of risk they pose...

When a new regulatory requirement is imposed, an organization's information security controls must be evaluated to ensure compliance. Risk assessment will help to determine the impact of the new regulatory requirement on the organization's information security controls. Once the risk assessment has been completed, the information security manager can then conduct a gap analysis to identify any gaps or deficiencies in the current information security controls that may need to be addressed to comply with the new regulatory requirement.

D makes for me sense.

cGPT: To gain a clear understanding of the impact that a new regulatory requirement will have on an organization’s information security controls, an information security manager should first conduct a risk assessment (Option B). A risk assessment will help identify potential risks and vulnerabilities that could be introduced by the new regulatory requirement. It will also help in understanding the likelihood and impact of these risks, which is crucial for determining the appropriate controls to mitigate them. After the risk assessment, the manager can then perform a gap analysis (Option D) to identify the differences between the current state of the organization’s security controls and the state required by the new regulation.

Because they are regulatory requirements, a gap analysis would be the first step to determine the level of compliance already in place.

Answer should be "B".

impact = risk assessment

Clearly it is B. Domain 3.

You can't properly measure risk without knowing your gaps. For example: The risk data leakage might come from a lack of IAM on an S3. You only know that after gap analysis. It would be B if D wasn't there. Between the 2, you chose D first.

Keyword is FIRST. Answer is B. You perform risk assessment. If that risk is acceptable, then only proceed to perform gap analysis.