Exam CISM topic 1 question 52 discussion

Risk-based approach strategy. C makes sense.

How can a gap analysis be performed for a security strategy that does not yet exist? The question poses the question as the initial (hence the term developing) security strategy. If you have no starting point, you cannot perform a gap analysis.

The best input to know your destination is where you are now.

c: The CISM All-0in-One Exam Guide Writes: Gap Assessment To implement a security strategy and accomplish objectives, security professionals often spend too much time focusing on the end goal and not enough time on the starting point. Without sufficient knowledge of the starting point, accomplishing objectives will be more difficult, and achieving success will be less certain. and it also writes: Risk Assessments A strategist should choose to have a risk assessment performed to reveal risks present in the organization. The results of a risk assessment give the strategist valuable information on the types of resources required to bring risks down to acceptable levels. This is vital for developing and validating strategic objectives. The Gap Assessment is valuable to implement the strategy. The Risk assessment validates your strategic objectives.

The results of an information security gap analysis provide a comprehensive understanding of the existing state of information security within an organization, identifying areas where security controls may be lacking or not meeting desired levels. This analysis helps in determining the current state of security and defining the desired future state, which is critical for developing an effective information security strategy. While measurement of security performance against IT goals (option B), results of a technology risk assessment (option C), and the availability of capable information security resources (option D) are important considerations, the information security gap analysis is a foundational step that informs the strategic direction and priorities for the development of the overall information security strategy.

A. Results of an information security gap analysis

hard one, A seems the best