Exam CISM topic 1 question 80 discussion

Pure D

Must be D.

This is the most effective approach because it directly ties the implementation of security controls to the organization's established security policy. By assessing the process against the defined security policy, the organization ensures that the controls are aligned with its security requirements, regulatory obligations, and overall security objectives.

Assessing the process against the organization's information security policy ensures that security controls are aligned with the organization's specific requirements and standards.

Assessing the process against the organization's information security policy ensures that security controls are aligned with the organization's specific requirements and standards. It provides a direct evaluation of whether the implemented controls meet the organization's expectations for safeguarding information. While using a recognized control framework (Option A) and reviewing the process for conformance with information security best practices (Option B) are important, directly assessing the process against the organization's information security policy is a more specific and targeted approach. Benchmarking the process against industry practices (Option C) may provide valuable insights, but it does not necessarily ensure alignment with the organization's specific security policy and requirements.

Does paid "Contributor Access" explain why it is A?

D. Assess the process according to information security policy The best way to validate that security controls are implemented in a new business process is to assess the process according to the organization's information security policy. This approach ensures that the security controls are aligned with the specific security requirements and standards established by the organization itself.

Certainly not A. A "recognized control framework" doesn't meant that it fits the objectives of the organization. The information security policy does, so response D is the only correct response.

D. Does the process align to the security policy

When the company already aligns to a control framework, verifying that business processes are using it ensures they would focus effort in the right direction

D. Assess the process according to information security policy

I like D

To validate basically we need to perform an assessment

D for sure!

D looks like the best answer here.

D. Assess the process according to information security policy would BEST validate that security controls are implemented in a new business process. By assessing the process against the organization's own information security policy, it ensures that the controls implemented align with the organization's overall security stance and meet their specific requirements.

Answer D