Exam CISM topic 1 question 53 discussion

Repeat after me..."Change equals risk". Having said that, that is the reason why infosec would want to manage CAB meetings, to keep the tech clowns in check.

Being involved in the change management process allows the information security manager to assess the potential risks associated with proposed changes to the organization's technology, processes, or systems. By evaluating risks, the information security manager can provide input to ensure that security considerations are addressed during the planning and implementation of changes. While options like ensuring that security controls drive technology changes (option A), updating security controls regularly (option C), and identifying potential vulnerabilities (option D) are also important, evaluating risks is a central aspect of ensuring that changes are made in a way that does not compromise the organization's information security posture.

B. While the other options (A, C, and D) are also important aspects of change management and information security, evaluating risks is the primary concern because it directly impacts the organization's security posture. Without a thorough evaluation of risks, security controls may not be effective in addressing new threats introduced by changes in technology or processes.

Changes cause risk whch should be evaluated

B. risks have been evaluated.

C in my opinion

B is correct

A. security controls drive technology changes is the best option