Exam CISM topic 1 question 211 discussion

According to ISACA, following a risk assessment, the next step after new countermeasures have been approved by management should be to develop an implementation strategy. This includes planning and coordinating the implementation of the countermeasures, and identifying any potential roadblocks or issues that may arise during the implementation process. This step is crucial to ensure that the implementation is successful and that the countermeasures are put in place in an efficient and effective manner. Once the implementation strategy is developed, schedule the target end date for implementation activities, budget the total cost of implementation activities, and calculate the cost for each countermeasure can be done.

How the management will approve without knowing the involved cost. I go with B

B, "Develop an implementation strategy," should be performed next. The correct sequence of actions might be: Develop an implementation strategy (B) Budget the total cost of implementation activities (C) Calculate the cost for each countermeasure (D) Schedule the target end date for implementation activities (A)

Never assume that the company missed a step. ISACA would never do this to you. If management approved that means we can surmise that every step before approval was completed. This makes the obvious answer B.

B, "Develop an implementation strategy," should be performed next. The correct sequence of actions might be: Develop an implementation strategy (B) Budget the total cost of implementation activities (C) Calculate the cost for each countermeasure (D) Schedule the target end date for implementation activities (A)

After the approval, start the implementation phase

Approval of countermeasures by the management needs the prior calculation of the cost of each countermeasure and budgeting. Developing an implementation strategy is a preamble to scheduling the implementation activities. So B is the good response.

How come the management approve the countermeasure without cost if answer is D?

calculate the cost so we can decide if it exceeds the asset value.

B. Develop an implementation strategy.

I think cost is required for approval. As approvals are already done one should start planning for execution

Calculation in D can be part of the strategy. So B should be more accurate i think.

After costs for countermeasures are approved, the implementation strategy must be defined along with the exact timelines (i.e. dates).

Not sure management would approve a counter measure without a business case detailing costs