Exam CISM topic 1 question 608 discussion

Answer is D: Because it reflects how well the organization is addressing known risks, which is a core measure of its security posture.

ALL IN ONE CISM EXAM GUIDE, Mc Graw Hill Information Security Program Metrics A metric is a measurement of a periodic or ongoing activity intended to help management understand the activity within the context of overall business operations. In short, metrics are the means through which management can measure key processes and know whether their strategies are working. Metrics are used in many operational processes, but this section emphasizes metrics related to security governance. In other words, there is a distinction between tactical IT security metrics and those that reveal the state of the overall security program. The two are often related, however, as discussed in the sidebar “Return on Security Investment,” later in this chapter.

I will go with C, senior leadership is involved here. assessing the risk progress can be done by the steering committee for option D but for senior leadership, C is more important probably.

I will go with D here. C is the responsibility of infosec manager, not senior leadership. However, senior leadership will assess the progress of risk mitigation efforts via metrics. But yeah, unnecessarily tricky question with somewhat bad wording.

Senior leadership always ties with Metrics. The technical jargon has to be dumbed down for senior leadership with metrics. No they are not building the metrics, but they need to insure they are part of reporting so that they can understand what is going on.

In order to ensure the risk is mitigated to the proper risk acceptance level senior leadership needs to assess the progress of risk mitigation efforts. Answer is D

I would say D, because C is not responsilibity of senior leadership. Establishment of metrics is responsibility of InfoSec Manager and senior leadership needs to make sure that they are assessing the progress of risk mitigation efforts.

Option C

C. ensure established security metrics are reported.

Answer: C I th

In order to understand an organization's security posture, it is MOST important for an organization's senior leadership to assess the progress of risk mitigation efforts (option D). According to ISACA, security posture is defined as "the security status of an enterprise’s hardware, software and policies. It is the overall security status of an enterprise’s information technology (IT) environment and activities. Security posture is determined by evaluating threats and vulnerabilities and by identifying potential areas of risk. The goal of security posture management is to maintain an optimal level of security for the enterprise’s systems and data."

Gonna have to go with risk mitigation as well.

I prefer C - ensure established security metrics are reported.

D. assess progress of risk mitigation efforts.