Exam CISM topic 1 question 731 discussion

I will go with B here; Reason: the question asks about desired outcome of information security governance which doesn't necessarily mean improved risk management as risk management will encompass more that IT Security, there will be other risks like supply chain, vendor risk and it will not only involve IT or IT Security. Business agility involves more than IT and IT security, if the product delivered by the business is rock solid and better than competitors then IT and IT security may aid to that achievement but not solely the main responsibility for business agility. A maturity model will provide the current state and the future state we want to get to by the process of continuious improvement which is governance.

A Business Agility Business Agility is a people-centred, organisation-wide capability that enables a business to deliver value to a world characterised by ever-increasing volatility, uncertainty, complexity, and ambiguity.

Option C

C. Improved risk management

Can rely on default answer and apply that in exam?

C. Improved risk management. Information security governance is the framework and processes implemented to ensure that information security aligns with business objectives, manages risks effectively, and supports organizational goals. One of the key objectives of information security governance is to improve risk management practices.

A desired outcome of information security governance is improved risk management.

it should be C means improved risk management

The desired outcome of information security governance is improved risk management

C. Improved risk management. One of the desired outcomes of information security governance is improved risk management. Effective information security governance helps organizations to better understand and manage the risks that they face, and to implement appropriate controls and procedures to mitigate those risks. This helps to ensure that the organization's information assets are protected, and that the organization is better positioned to respond to security incidents. Other outcomes of information security governance, such as penetration testing, a maturity model, and business agility, may be important as well, but they are not as directly related to the goal of improved risk management.