Discuss Isaca CISM Exam Topic 1 Question 104

Which of the following is the BEST indication that an organization has a mature information security culture?

AInformation security training is mandatory for all staff.

BThe organization's information security policy is documented and communicated.

CThe chief information security officer (CISO) regularly interacts with the board.

DStaff consistently consider risk in making decisions.

Suggested Answer: D

The BEST indication that an organization has a mature information security culture is when its staff consistently consider risk in making decisions. When an organization's staff understands the risks associated with their actions and are empowered to make risk-informed decisions, it indicates that the organization has a mature information security culture.

According to the Certified Information Security Manager (CISM) Study Manual, 'A mature information security culture exists when the people within the organization understand and appreciate the risks associated with information and technology and when they take steps to manage those risks on a daily basis.'

While information security training, documented information security policies, and regular interaction between the chief information security officer (CISO) and the board are all important components of a mature information security culture, they are not sufficient on their own. It is only when staff consistently consider risk in making decisions that an organization's information security culture can be considered mature.

Certified Information Security Manager (CISM) Study Manual, 15th Edition, Pages 151-152.

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

30 comments · newest first

Tamar 6 months ago

I feel like D really integrates security into daily work.

Lindsey 6 months ago

C is good for leadership, but D impacts everyone.

Stanford 6 months ago

B is crucial for clarity, but it’s not enough alone.

Royal 6 months ago

A is important too, but it feels more like a checkbox.

Stefany 7 months ago

Wait, are we really saying D is the best? Sounds too idealistic!

Alton 7 months ago

B) Documented policies are important, but they need to be followed too.

Justine 7 months ago

C) Regular CISO interaction is key for top-down support.

Delfina 8 months ago

D) Absolutely! Risk consideration should be second nature.

Adelle 8 months ago

A) Mandatory training is a good start, but not the whole picture.

Shizue 8 months ago

D) Staff consistently consider risk in making decisions. Sounds like a no-brainer to me. What could go wrong?

Wava 8 months ago

A) Information security training is mandatory for all staff. This helps embed security awareness throughout the organization.

Kenda 8 months ago

C) The chief information security officer (CISO) regularly interacts with the board. This shows security is a priority at the highest levels.

Nieves 8 months ago

B) The organization's information security policy is documented and communicated. This ensures everyone is on the same page.

Nieves 9 months ago

D) Staff consistently consider risk in making decisions. This is the best indicator of a mature security culture.

Dawne 9 months ago

I recall discussing how CISO engagement with the board is crucial, but I wonder if that alone is enough to reflect the overall culture.

My 9 months ago

I feel like B is important too, but just having a documented policy doesn't mean the culture is mature. It needs to be more than just paperwork.

Milly 9 months ago

I'm not entirely sure, but I remember a practice question where mandatory training was highlighted as a key indicator. Maybe A is also a strong contender?

Irene 9 months ago

I think option D might be the best choice since it shows that staff are actively considering security in their daily decisions, which indicates a deeper cultural understanding.

Zena 9 months ago

I'm a bit torn between B and D. Both seem like good indicators, but I think D might be the best overall measure of a mature security culture.

Antonio 10 months ago

I agree, D reflects a proactive mindset.

Erick 10 months ago

D is the way to go for me. If employees are naturally factoring in security risks, that's a strong sign the culture is really healthy and mature.

Amalia 10 months ago

I think D is the best choice. It shows real engagement.

Ocie 10 months ago

I'm leaning towards C. If the CISO is regularly interacting with the board, that suggests security is a top priority at the highest levels.

Cherry 11 months ago

Hmm, I'm not sure. B seems like a good option too - having a documented policy that's communicated is a pretty clear sign of a mature security culture.

Chauncey 11 months ago

I think the best indication is D. Staff consistently considering risk in their decisions. That shows the security culture is really embedded in the organization.

Beth 5 months ago

↳ replying to Chauncey

C is good, but D is where the real change happens.

Tijuana 5 months ago

↳ replying to Chauncey

True, if everyone is considering risk, it means training worked!

Lynna 6 months ago

↳ replying to Chauncey

A and B are important too, but D is the key.

Mitzie 6 months ago

↳ replying to Chauncey

I agree, D really shows a strong culture.

Bette 10 months ago

↳ replying to Chauncey

Definitely! When staff think about risk, it becomes second nature.

Isaca CISM Exam - Topic 1 Question 104 Discussion