Exam CISM topic 1 question 306 discussion

The Correct answer is B: Risk Classification. The reason is that B is the only one that allows you to effectively compare resources against another using a standardized set of criteria. Rationale: A. Capability maturity assessment can be used to identify areas where the organization needs to improve its security posture, but it does not provide information on the relative importance of different risks. C. Return on investment (ROI) is a financial instrument used to justify the purchase of something but says nothing about the relative risks and how to address them. D. Internal audit reports provide the findings, but does not provide for prioritization of risk.

B. The Security manager job is to reduce or mitigate risk to a acceptable level so focusing on risk classification aligns perfectly with that. I would choose 'A' before i chose 'C" since CMM allow the re-engineering of processes for efficiency and completeness.

B is the no brainer choice here!

I think it's B. Just think what your job is - are you going to potentially compromise security just because ROI for a certain security tool is not optimal, and disregard the risk and criticality level of an asset?

Because it is initiated by senior management, the best answer here is C. Return on investment (ROI). Senior management always focuses on the big picture and as such it will serve the Security manager well to focus on ROI.

B. Risk classification As CISM personal, i will analyse the risk first before looking in ROI

C. Return on investment (ROI): When resources are being allocated to streamline processes and reduce costs, it's crucial to determine the potential return on investment for each proposed action. ROI helps evaluate the cost-effectiveness of initiatives and ensures that resources are directed toward activities that deliver the greatest value in terms of reduced costs and improved efficiencies.

Risk Classifications are the most accurate answer.

B. Risk classification

C. Return on Investment(ROI) of the security tools

for reduction of cost, ROI should be chosen.

I guess it could be C