Exam CISM topic 1 question 513 discussion

BEST view of the organization's existing security posture is provide by the risk assessment. But don't forget that your FIRST step is to talk to the current management and then perform the Risk assessment. Correct answer is C.

C. Performing a risk assessment would provide a newly appointed information security manager with the best view of the organization's existing security posture. This is because a risk assessment is a comprehensive process for identifying, assessing, and prioritizing the risks facing an organization, and determining the appropriate controls and countermeasures to mitigate those risks. A risk assessment will provide the information security manager with a clear understanding of the organization's vulnerabilities and threats, as well as the existing controls in place to mitigate those risks, which is an important step in identifying areas where the security posture can be improved.

The question ask for what will give the "BEST" view and not the FIRST task or for that matter in what order. The Best VIEW of security posture will be provided from Risk Assessment either its done first, second or last.

Interview would be the FIRST thing you do, but the question is about BEST thing to do, and risk assessment is by far the best.

Interviewing business managers and employees is the FIRST one to do but risk assessment provide the BEST view

You would definitely have to interview business managers, but that is only part of the story. The most comprehensive answer would be C, IMO.

Stop listening to chatgpt blindly guys. You can not perform a risk assessment without even knowing what you'll be assessing. It's common sense people. Interview managers and employees will give you an accurate picture of the company's security posture after which you can perform a risk assessment based on the information you've gathered.

C. Performing a risk assessment Performing a risk assessment would provide a newly appointed information security manager with the BEST view of the organization's existing security posture. A risk assessment involves identifying and evaluating potential risks and vulnerabilities within the organization's systems, processes, and assets. This process provides insight into the current state of security, helps prioritize security measures, and informs the development of a comprehensive security strategy. It often includes reviewing policies and procedures, but it goes beyond that by assessing the actual risks and vulnerabilities in the organization's environment. Interviewing business managers and employees can also be part of the risk assessment process to gather additional information and insights.

RA and TA are the BEST to start with .

C. Performing a risk assessment

to understand total security posture, interview is best solution.