Exam CISM topic 1 question 49 discussion

A. Again, you have to get out of the technical solution mindset. Its not correct and you will fail. You are a manager and are serving a business function. Policies and procedures are you job, hands on enforcing encryption is for the folks lower on the totem poll. You policy will dictate how other teams will implement the solution - you are hands off baby.

I would go for D. we are talking about mobile devices which might get stolen...and they must get remotely wiped out according to the Security Policy. The question is more related to the mobile device...and not generally to the Policies that the CISO takes care of....in my opinion.

While the other options (A, C, and D) are also important responsibilities of an information security manager, enforcing passwords and data encryption on mobile devices directly addresses the security of the devices themselves and the protection of sensitive information they may contain or access.

Enforcing passwords and data encryption on mobile devices is a fundamental security measure to protect sensitive information in case of device loss or theft. Passwords add a layer of access control, and data encryption ensures that even if the device is compromised, the stored data remains secure. While reviewing and updating existing security policies (option A), conducting security awareness training (option C), and requiring remote wipe capabilities for devices (option D) are important aspects of mobile device security, enforcing passwords and data encryption directly addresses the protection of data on the devices themselves, which is a foundational responsibility for information security managers in a mobile device implementation scenario.

B While the other options (A, C, and D) are also important responsibilities of an information security manager, enforcing passwords and data encryption on mobile devices directly addresses the security of the devices themselves and the protection of sensitive information they may contain or access.

b option will be a subset of a. so A is more correct

A looks good

Enforce passwords and data encryption on the devices = primary responsibility

The primary responsibility of an information security manager in an organization that is implementing the use of company-owned mobile devices is to enforce passwords and data encryption on the devices. Mobile devices, such as smartphones and tablets, are highly portable and can contain sensitive information. Enforcing passwords and data encryption on these devices is essential for maintaining the security and confidentiality of the data they hold. By requiring strong passwords and implementing data encryption, the information security manager helps protect the devices and the information stored on them from unauthorized access. Passwords ensure that only authorized users can access the devices, while data encryption adds an additional layer of protection by encoding the data to prevent unauthorized viewing or retrieval in case the device is lost or stolen.

C- Conduct security training. To increase awareness on the staff.

Whose responsibilities of B and D?

A. Review and update existing security policies.

A, then B & D