Isaca CISM Exam - Topic 1 Question 87 Discussion

Actual exam question for Isaca's CISM exam

Question #: 87
Topic #: 1

Following a risk assessment, an organization has made the decision to adopt a bring your own device (BYOD) strategy. What should the information security manager do NEXT?

ADevelop a personal device policy

BImplement a mobile device management (MDM) solution

CDevelop training specific to BYOD awareness

DDefine control requirements

Show Suggested Answer

Suggested Answer: D

Defining control requirements is the next step to ensure the security policy framework encompasses the new business model because it is a process of identifying and specifying the security measures and standards that are needed to protect the data and applications accessed by the BYOD devices. Defining control requirements helps to establish the baseline security level and expectations for the BYOD strategy, as well as to align them with the business objectives and risks. Therefore, defining control requirements is the correct answer.

https://www.digitalguardian.com/blog/ultimate-guide-byod-security-overcoming-challenges-creating-effective-policies-and-mitigating

https://learn.microsoft.com/en-us/mem/intune/fundamentals/byod-technology-decisions

by Madelyn at Sep 19, 2024, 07:35 PM

Limited Time Offer

25%

Off

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Chun

6 months ago

Wait, are people really okay with using their personal devices for work?

upvoted 0 times

...

Yun

6 months ago

Control requirements are crucial, but not sure if they should be first.

upvoted 0 times

...

Lucille

6 months ago

Training for BYOD awareness is super important too!

upvoted 0 times

...

Claribel

7 months ago

I think implementing MDM should come before anything else.

upvoted 0 times

...

Lashonda

7 months ago

Definitely need a personal device policy first!

upvoted 0 times

...

Mauricio

7 months ago

I vaguely recall that defining control requirements is crucial, but I can't remember if it comes before or after the policy development.

upvoted 0 times

...

Gwenn

7 months ago

Developing training for BYOD awareness sounds important, but I feel like we need to establish some controls first.

upvoted 0 times

...

Malissa

7 months ago

I remember a practice question where we had to implement MDM right after deciding on BYOD. Maybe that's what we should do next?

upvoted 0 times

...

Emilio

8 months ago

I think the first step should be developing a personal device policy, but I'm not entirely sure if that's the best starting point.

upvoted 0 times

...

Yuette

8 months ago

Developing BYOD awareness training for employees is crucial, so I'm leaning towards option C. But I also need to consider the other options to make sure I choose the best next step.

upvoted 0 times

...

Fletcher

8 months ago

Okay, I've got this. The key here is to establish clear guidelines and controls for the BYOD strategy. I'll go with option D - defining the control requirements.

upvoted 0 times

...

Salina

8 months ago

Hmm, I'm a bit unsure about this one. Should I focus on developing a policy, implementing MDM, or defining control requirements? I'll need to think this through carefully.

upvoted 0 times

...

Brynn

8 months ago

This seems like a straightforward question about BYOD implementation. I think I'll go with option B - implementing an MDM solution to manage the personal devices.

upvoted 0 times

...

Remona

8 months ago

Hmm, I'm a bit confused by the wording here. I'll need to make sure I understand the difference between voice ports and dial-out ports.

upvoted 0 times

...

Oliva

2 years ago

What, no option for 'hide under the desk and hope it goes away'? That's my personal device policy!

upvoted 0 times

Ty

2 years ago

C) Develop training specific to BYOD awareness

upvoted 0 times

...

Isidra

2 years ago

B) Implement a mobile device management (MDM) solution

upvoted 0 times

...

Annamae

2 years ago

C) Develop training specific to BYOD awareness

upvoted 0 times

...

Latosha

2 years ago

B) Implement a mobile device management (MDM) solution

upvoted 0 times

...

Nidia

2 years ago

A) Develop a personal device policy

upvoted 0 times

...

Lili

2 years ago

A) Develop a personal device policy

upvoted 0 times

...

Keneth

2 years ago

Defining control requirements is key. Gotta set those boundaries and guidelines for BYOD, you know?

upvoted 0 times

Kati

2 years ago

D) Define control requirements

upvoted 0 times

...

Tamala

2 years ago

C) Develop training specific to BYOD awareness

upvoted 0 times

...

Luisa

2 years ago

B) Implement a mobile device management (MDM) solution

upvoted 0 times

...

Alex

2 years ago

A) Develop a personal device policy

upvoted 0 times

...

Aimee

2 years ago

I think implementing a mobile device management solution would be more effective in managing security risks.

upvoted 0 times

...

Melissia

2 years ago

BYOD awareness training is crucial. Gotta make sure everyone knows how to use their devices securely, am I right?

upvoted 0 times

Salley

2 years ago

B) Implement a mobile device management (MDM) solution

upvoted 0 times

...

Weldon

2 years ago

C) Develop training specific to BYOD awareness

upvoted 0 times

...

Caprice

2 years ago

A) Develop a personal device policy

upvoted 0 times

...

Colton

2 years ago

I agree with Lashawn. It's important to have clear guidelines in place.

upvoted 0 times

...

Carli

2 years ago

Implementing an MDM solution sounds like a good next step to me. It'll help manage all those personal devices on the network.

upvoted 0 times

...

Nadine

2 years ago

I think the information security manager should develop a personal device policy first. It's the foundation for BYOD implementation.

upvoted 0 times

Omega

2 years ago

D) Define control requirements

upvoted 0 times

...

Rikki

2 years ago

C) Develop training specific to BYOD awareness

upvoted 0 times

...

Ira

2 years ago

B) Implement a mobile device management (MDM) solution

upvoted 0 times

...

Remedios

2 years ago

A) Develop a personal device policy

upvoted 0 times

...

Lashawn

2 years ago

I think we should develop a personal device policy first.

upvoted 0 times

...