Exam CISM topic 1 question 47 discussion

D makes more sense since this is the MOST important to start sorting the issues considering the risk and then start checking the cost of the mitigation control vs the impact.

controls are designed to mitigate risks.

Applying a risk-based approach involves identifying and assessing the risks faced by the organization and then designing security controls that are proportionate to the identified risks. This ensures that resources are allocated efficiently and that security measures are aligned with the organization's risk tolerance and priorities. While focusing on preventive controls (option A) is important, an exclusive focus on prevention may not adequately address all potential risks. Applying controls to confidential information (option B) is essential but should be guided by the overall risk landscape. Evaluating the costs associated with controls (option C) is also important, but cost-effectiveness should be considered in the context of risk reduction. A risk-based approach helps organizations prioritize and tailor their security controls to address the most significant threats and vulnerabilities.

You can suggest 10M solution to save 1M company. So cost is important factor for designing a control.

You apply a risk-based approach for the asset with the control in mind. This question is for the control only, C is then the correct answer.

D definitely. C is also important but as an ISM your job is all about considering risk.

D While preventive controls (option A) are important, they are only one aspect of a comprehensive security strategy. Focusing solely on preventive controls without considering the organization's specific risks may result in inefficient resource allocation and an inadequate response to the most critical threats. Applying controls to confidential information (option B) is also important but should be guided by the overall risk assessment and not solely based on confidentiality. Different types of information may have varying levels of sensitivity, and a risk-based approach helps determine appropriate controls for each. In summary, applying a risk-based approach to security control design ensures that an organization's security measures are tailored to its unique risk profile, leading to more effective and efficient security.

C. This is where experience comes in. Anyone who designs controls without cost in mind will know they will immediately be rejected by Senior Management. Its a waste of time if you dont consider cost. Also, this is a Business Mindset exam, not a sec analyst exam. Cost is everything for the CISM.

If you don't know the risk, how would you calculate the cost vs benefit. I would think D is a better option than C. Interested to hear why is C a better answer than D?

Answer C Think about small organisation which dont have much capital to invest, but has high potential risk for it's business vector. This kind of organisation looking for cost effective compensation controls instead of implementing expensive security controls. Hence top most priority is cost on selecting the controls.

D. apply a risk-based approach.

D. Apply a risk-based approach is the MOST important when designing security controls. This means identifying and prioritizing risks, assessing the likelihood and impact of potential threats, and selecting controls that are appropriate and cost-effective to mitigate those risks. A risk-based approach ensures that security controls are tailored to the specific needs of the organization and aligned with its business objectives. While preventive controls are important, they may not be sufficient to address all security risks. It is also important to consider detective and corrective controls to detect and respond to security incidents. Confidential information may require more stringent controls, but all information assets should be assessed for risk and addressed accordingly. Finally, the costs associated with the controls should be evaluated, but this should not be the only consideration, as the cost of a security breach can be much higher.

The correct answer is D. Risk reduction is the primary objective of any control implementation.

D is correct. Cost of the control is important but you should consider the value of protected data as well.

Folks. The answer is D. Repeat after me..."Take a risk-based approach". All other options are part of taking an RBA. Always take a risk based approach when identifying controls. Did I mention...take a risk based approach when identifying controls? :)

Agree to be B

C & D are ok