MENU
An organization is planning to open a new office in another country. Sensitive data will be routinely sent between the two offices. What should be the information security manager's FIRST course of action?
Suggested Answer: D
Get Premium CISM Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
The first course of action is to identify applicable regulatory requirements (D). CISM governance requires understanding legal and regulatory obligations before defining policies, controls, or technical measures. Encryption (B), training (A), and policy updates (C) must be based on regulatory requirements to ensure compliance and avoid legal exposure. Jurisdictional risk assessment is foundational when operating across borders.
27 comments · newest first
EV
Eva
3 months ago
Agreed! Encryption should be a priority from the start.
NI
Niesha
3 months ago
Definitely need to establish secure communication channels.
PE
Pearly
3 months ago
I think they should conduct a risk assessment.
LU
Lucy
3 months ago
Assess the current security protocols first.
ST
Stefania
4 months ago
Surprised they haven't done this already!
DA
Dana
5 months ago
I think a risk assessment should come before anything else.
LE
Leonie
5 months ago
Wait, are they even considering encryption?
GE
Genevive
5 months ago
Totally agree, compliance is key!
AR
Arlette
6 months ago
They should assess the data protection laws in that country first.
AP
Apolonia
6 months ago
Encrypt the data, use a VPN, and don't forget to install a firewall. Gotta cover all the bases!
BU
Bulah
6 months ago
Carrier pigeons are the most secure way to transmit sensitive data these days.
CH
Christene
6 months ago
Hire a team of hackers to test the security of the new office's network.
DA
Dalene
6 months ago
Encrypt all data before transmission to ensure confidentiality.
CA
Casey
6 months ago
Conduct a risk assessment to identify potential threats and vulnerabilities.
CE
Cecily
7 months ago
Implement a secure VPN connection between the offices to protect the sensitive data.
SH
Sharika
7 months ago
I vaguely recall a practice question where we had to prioritize data encryption. Could that be the first action here too?
BO
Bo
7 months ago
Maybe the manager should focus on establishing a secure communication channel first? I feel like that’s a common practice in similar scenarios.
FR
France
8 months ago
I'm not entirely sure, but I remember something about conducting a risk assessment before implementing any data transfer protocols.
TO
Toi
8 months ago
I think the first step should be to assess the legal and regulatory requirements for data transfer between countries. That seems crucial.
IN
In
8 months ago
This is a tricky one. I'd need to consult with the legal and IT teams to make sure we cover all the compliance and technical bases.
SH
Sharika
8 months ago
I'd recommend looking into VPNs, secure file transfer protocols, and other technical solutions to protect the sensitive data in transit.
WY
Wynell
8 months ago
Establishing secure communication channels would be my top priority. Encryption, access controls, and monitoring should all be considered.
EA
Earleen
9 months ago
Hmm, this seems like it requires a comprehensive security plan. I'd want to evaluate the risks and vulnerabilities first before deciding on the best approach.
ME
Meghann
9 months ago
I'd start by assessing the data sensitivity and any regulatory requirements for secure data transfer. That should guide the initial security measures.
DE
Detra
2 months ago
Agreed! Then we can plan the security measures.
NE
Nelida
2 months ago
Definitely! Regulatory requirements are crucial too.
TY
Ty
3 months ago
Assess the data sensitivity first.