QUESTION: 209

Who should decide the extent to which an organization will comply with new cybersecurity regulatory requirements?

Senior management
IT steering committee
Legal counsel
Information security manager

Answer(s): A

QUESTION: 210

Which of the following would BEST help an information security manager prioritize remediation activities to meet regulatory requirements?

A capability maturity model matrix
Annual loss expectancy (ALE) of noncompliance
Cost of associated controls
Alignment with the IT strategy

Answer(s): D

Show Answer Next Question

QUESTION: 211

Which of the following is the PRIMARY reason an information security strategy should be deployed across an organization?

To ensure that the business complies with security regulations
To ensure that management's intent is reflected in security activities
To ensure that employees adhere to security standards
To ensure that security-related industry best practices are adopted

Answer(s): A

Show Answer Next Question

QUESTION: 212

Which of the following is the BEST option for addressing regulations that will adversely affect the allocation of information security program resources?

Prioritize compliance efforts based on probability.
Determine compliance levels of peer organizations.
Delay implementation of compliance activities.
Conduct assessments for management decisions

Answer(s): D

Show Answer Next Question

Free ISACA CISM Exam Braindumps (page: 54)

QUESTION: 209

QUESTION: 210

QUESTION: 211

QUESTION: 212

CISM Exam Discussions & Posts