Exam CISM topic 1 question 644 discussion

In simple words organization’s information security strategy is something that's tailored based on where the org wants to be (a.k.a risk apetite) audits results are based on complaince.

Correct answer is A: Internal security audit. Because it allows the security manager to systematically evaluate whether the strategy is holistic, risk-aligned, and effectively implemented.

So many of you have selected Audits here. Not sure how you can audit a strategy.

C. External security audit An external security audit involves an independent examination of an organization's information security policies, processes, and controls by an external entity. This audit assesses the organization's adherence to established standards and best practices, helping to determine the comprehensiveness of the information security strategy. External audits provide an objective perspective and can identify areas for improvement, potential vulnerabilities, and gaps in the security strategy that may not be apparent in internal assessments. While internal security audits (Option A) and other assessments are valuable, an external audit adds an extra layer of validation and objectivity to the evaluation process.

Straight from multiple professional pentesters mouth. A company will almost always pass an internal audit either that be them knowing they are lying or on accident. For the most compressive dive into a businesses security a 3rd party audit needs to be performed.

How is internal audit better than independent (external) audit? Prove this to me. Answer is C

Option C

They really shouldn't have put two audit answers, it really could be either one of them. CISM's view on audits, as given in CISM Review Manual 27th Edition, is on page 47: "Audits provide the ultimate assurance of compliance because they are independent and are based on recognized standards. Audits cover the entire IS management process from risk identification and control design to control operation and monitoring." On page 121, it mentions: "Internal audits: The goal of internal audits is to provide assurance to management that controls are working as designed and are effective in managing the organization's risks." And on page 46, it states: "External audits: External audits provide an independent, objective assessment of the effectiveness of controls in managing an organization's information security risks." There really is no clear answer, based on the material alone. and although external seems to provide the most sense if the question were objectivity, I think internal often provides more in depth.

C. External security audit

Answer B: Because a Risk Appetite will decide how comprehensive the Security Strategy should be. Risk Appetite drive security strategy.

A. Internal security audit

Seeing as the question is asking for BEST method to get 'comprehensiveness'. I would go with an 3rd party independent audit of the InfoSec program. Which in this case is Option C. Organization risk appetite can give a good understanding of the program but complete details I don't think so.

Internal audit

I guess B

comprehensive understanding is provided by external audit.