Exam CISM topic 1 question 568 discussion

C. Business processes and requirements An effective information security strategy should align with the overall business objectives and support the organization's processes and requirements. Without understanding the business processes and requirements, it is difficult to develop a strategy that addresses the specific needs of the organization and aligns with its goals. A security strategy that does not align with the organization's objectives and processes is less likely to be effective in reducing risk and protecting the organization's assets.

D - Risk assessments help identify and prioritize the most significant threats to the organization, ensuring that the security strategy addresses the most critical areas first.

I am not sure but I'd go with B. Risk and business impact assessments are most important input to define current state. Business processes and requirement are most important input to define desiderate state.

B is very tempting and i went for it first but C is the correct answer

The question asks about the "development" of a strategy not one that already exists in which case you could compare existing with desired states. It is definitely C

Agree to the answer B Current and desired state of security

D. The MOST important input to the development of an effective information security strategy is risk and business impact assessments.

B. Current and desired state of security Understanding the current state of security (the existing vulnerabilities, threats, and weaknesses) and the desired state of security (the goals and objectives for improved security) is fundamental to developing an effective information security strategy. Without this understanding, it's challenging to define the direction, priorities, and actions necessary to protect an organization's information assets.

B sounds correct.

I have been an auditor, and in my experience all strategies have contained a current state & desired state roadmap. I will be going with B 👍🏼

C. Business processes and requirements

By assessing the current state of security and comparing it to the desired state, organizations can determine the necessary steps and initiatives to bridge the gaps and achieve their security goals. This analysis helps in setting priorities, allocating resources, and creating a roadmap for implementing security controls and measures.

Most important input would be the target identified by gap analysis. Without this you can't build a strategy even if you know what the business processes and requirements are.

Business processes and requirements.