Exam CISM topic 1 question 505 discussion

BIA - While building support it would be most helpful to know how you will be affected, also a BIA needs to be conducted before a risk assessment.

An information security program would be risk based, BIA only provide worse case scenarios but risk assessment would include impact (BIA) x likelihood which would be more useful and important.

D. Information risk assessment. Information risk assessment is the most important element because it provides a clear understanding of how security risks affect the organization and helps secure management buy-in for the security program.

leaning towards A

The risk assessment helps to identify potential threats, while the BIA helps prioritize which processes are most critical to the business. Answer is A

I have read several explanations below. Addressing just few to help others understand the flaws in the arguments. Please note, I mean no disrespect to the comment owners. Dravidian: How you will be affected, i.e., impact is important. But what if likelihood is zero. BIA considers only internal factors (value of asset to business). RA considers both internal and external factors (threats, likelihood, vulnerabilities, exposure, and impact). BIA can be conducted before or sometimes as part of risk assessment. Besides, the question is asking not about what is done first but what is most important. 6and0: It is not uncommon for BIA to be done before establishing the IS program. Afterall, Risk Assessment is incomplete without impact assessment. To build support for IS program, threat, vulnerability, or impact by themselves mean nothing if the

Risk assessment first!

Guys, please stop using ChatGPT to justify your answers. You are doing a disservice to yourself and others. Keywords in the question - building support for an information security program Business impact analysis (BIA) – When are you preforming the BIA? Before you have an established info security program? Im going with D. Information risk assessment- Yes, I don’t like the wording “Information” being part of it. But my guess is its not in the answer in the actual exam.

A. Business impact analysis (BIA) When building support for an information security program, the most important element is often the business impact analysis (BIA). The BIA helps organizations understand the potential impact of various security incidents and threats on their business operations. It identifies critical assets, processes, and functions and assesses how their disruption could affect the organization's ability to achieve its objectives. By demonstrating the potential financial, operational, and reputational risks associated with security incidents, a BIA can help stakeholders, including senior management and decision-makers, recognize the importance of investing in and supporting information security measures. It provides the necessary context to prioritize security efforts and allocate resources effectively to mitigate risks and protect the organization's interests.

D. Information risk assessment: This is typically considered the most important element because it forms the foundation of your information security program. A risk assessment helps you identify and understand the risks your organization faces, which is crucial for making informed decisions about where to allocate resources and what security measures to implement. it typically comes after risk assessment and threat analysis in the planning process. BIA helps you prioritize resources and develop strategies to minimize the impact of security incidents.

D , Bia has to do mostly with BCP

i vote ........D. Information risk assessment

Option A

Therefore, option A, Business Impact Analysis (BIA), is the most important element when building support for an information security program. It helps stakeholders understand the significance of information security measures in protecting critical business functions and assets

D information risk assessment is the most important element when building support for an information security program. An information risk assessment is the process of evaluating what information assets an organization holds, how critical they are, and what threats and risks they are exposed to. The information risk assessment helps prioritize risks and is used to determine the resources and priorities needed for the program. Other options, BIA, threat analysis, and identification of existing vulnerabilities may be included in the information risk assessment, but are each part of the information risk assessment.

This is D. A risk assessment will inform the business of the infosec risks and provide justification/business case. ALSO a BIA is done on a system like an ERP, it would not be used to justify an infosec program.

When building support for an information security program, the MOST important element is the Information risk assessment (Option D).