Exam CISM topic 1 question 525 discussion

D. To establish a minimum acceptable security baseline is the primary purpose of implementing information security standards. Standards provide a framework for achieving a set of security objectives and establish a common set of security controls and guidelines that organizations should implement to protect their information systems. They are designed to be a starting point for organizations to build their own security programs and help ensure that the security measures in place are adequate to protect the organization's sensitive information and assets. Standards provide a common language and a consistent approach to security, which helps organizations to understand their security risks, identify vulnerabilities, and implement appropriate controls to mitigate those risks.

The answer is D: Standards define minimum security requirements tailored to a specific organization. An example could be the usage of TLS 1.2 or above or password complexity requirements. The answer is NOT B, since step by step instructions are covered by procedures. Procedures are one level below standards and contain detailed instructions on how to perform certain tasks (e.g., like a manual). The answer is NOT C, since security objectives are derived from business objectives (security as a supporting function for the business). There is no relation to standards - just forget about this answer option.

C. To provide management direction with a specific security objective. Information security standards are typically designed to provide a set of guidelines, principles, or requirements that help organizations establish and maintain a secure information environment. These standards offer management direction by outlining specific security objectives and expectations. They serve as a foundation for developing information security policies (Option A) and often include best practices and controls to establish a minimum acceptable security baseline (Option D). While some standards may include procedural details, their primary focus is to provide overarching guidance and direction for achieving security goals within an organization

To establish a minimum acceptable security baseline

C. To provide management direction with a specific security objective.

D. To establish a minimum acceptable security baseline