Exam CISM topic 1 question 168 discussion

Summary of responsibilities as it concerns policies: - CISO is responsible for overseeing the creation of policies - InfoSec Governance is responsible for creating policies - Senior Management is responsible for reviewing and endorsing. - IT Steering Committee is responsible for approving policies. - Security Administrators implement and enforce the policies

Senior Mgt.

B. senior management.

The correct answer is B Cause The information security policy should be reviewed and endorsed by the organization's senior management. This is because senior management is responsible for the overall security of the organization and for ensuring that the information security policy is aligned with the organization's business goals. Also endorsing it gives it the authority and weight that it needs to be effective. (A) Is incorrect cause security administrators apply the enforcement but don't write the policy (C) Is incorrect cause this isn't inclusive (D) is Incorrect cause this doesn't span multiple departments.

B is my choice. "IT" in the "IT Steering Committee" is what was throwing me off. I was going to select this, but then realized that. If it was the "Security Steering Committee," I believe this would have been the answer. Concurring with Baranikumar_v below.

committee approved security policy.