Discuss Isaca CISM Exam Topic 3 Question 74

Which of the following is MOST helpful in determining an organization's current capacity to mitigate risks?

ACapability maturity model

BVulnerability assessment

CIT security risk and exposure

DBusiness impact analysis (BIA)

Suggested Answer: C

Data encryption standards are the best information security initiative for creating an enterprise strategy for protecting data across multiple data repositories and different departments because they help to ensure the confidentiality, integrity, and availability of data in transit and at rest. Data encryption is a process of transforming data into an unreadable format using a secret key or algorithm, so that only authorized parties can access and decrypt it. Data encryption standards are the rules or specifications that define how data encryption should be performed, such as the type, strength, and mode of encryption, the key management and distribution methods, and the compliance requirements. Data encryption standards help to protect data from unauthorized access, modification, or theft, as well as to meet the regulatory obligations for data privacy and security. Therefore, data encryption standards are the correct answer.

https://www.techtarget.com/searchdatabackup/tip/20-keys-to-a-successful-enterprise-data-protection-strategy

https://cloudian.com/guides/data-protection/data-protection-strategy-10-components-of-an-effective-strategy/

https://www.veritas.com/information-center/enterprise-data-protection

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

40 comments · newest first

Luis 10 months ago

Surprised that people aren't mentioning IT security risk and exposure!

Kristofer 11 months ago

Capability maturity model helps too, but I lean towards B.

Mabel 11 months ago

Wait, isn't a business impact analysis more about potential impacts than current capacity?

Lilli 11 months ago

Totally agree, B is the way to go!

Cordelia 11 months ago

I think a vulnerability assessment is key for understanding current risks.

Gaston 12 months ago

Business impact analysis sounds familiar, but I can't recall if it's more about understanding impacts rather than assessing current risk capacity.

Jonelle 12 months ago

I feel like IT security risk and exposure could be a strong contender here, especially since it focuses on actual risks faced by the organization.

Jennie 12 months ago

I remember practicing with vulnerability assessments in class; they seem crucial for identifying weaknesses, but is that what they mean by "current capacity"?

Lura 1 year ago

I think the Capability Maturity Model might be relevant, but I'm not entirely sure how it directly relates to risk mitigation.

Charlie 1 year ago

I feel pretty confident that the capability maturity model is the best answer here. It gives a comprehensive view of an organization's risk management processes and capabilities.

Pearlie 1 year ago

The business impact analysis (BIA) could also provide useful insights into the organization's risk mitigation capabilities. I'll need to review my notes on these different risk assessment frameworks.

Effie 1 year ago

This seems like a straightforward question about risk management. I think the capability maturity model would be the most helpful in determining an organization's current risk mitigation capacity.

Vanda 1 year ago

Hmm, I'm not sure about this one. The vulnerability assessment and IT security risk and exposure options also seem relevant. I'll have to think this through carefully.

Frederica 1 year ago

I'm a bit confused by some of the terminology in this question. I'll need to review my notes to make sure I'm interpreting everything correctly.

Arlyne 1 year ago

I'm not totally sure about this one. I don't want to just tell the customer they're wrong, but I also don't want to share their story with colleagues without their permission. I'll have to re-read the question and options carefully.

Winfred 1 year ago

I remember something about the certificate name needing to match. That feels like it could be one of the reasons.

Gerald 1 year ago

I'd just build a giant flamethrower to burn down the risks. Problem solved!

Jesusita 1 year ago

↳ replying to Gerald

C: IT security risk and exposure could also provide valuable insights into our organization's current risk mitigation capabilities.

Ernest 1 year ago

↳ replying to Gerald

B: I agree, a vulnerability assessment would give us a better understanding of where our weaknesses are.

Yuriko 1 year ago

↳ replying to Gerald

A: That might not be the most effective solution. We should consider using a vulnerability assessment to determine our current capacity to mitigate risks.

Cherry 1 year ago

Wait, which one lets me use the most buzzwords? I'm going with IT security risk and exposure - that's got to be the winner!

Jesusa 1 year ago

Business impact analysis, for sure! That's where you really get to the heart of the organization's risk exposure.

Sharee 1 year ago

↳ replying to Jesusa

Capability maturity model can also provide valuable insights into the organization's risk management capabilities.

Tamesha 1 year ago

↳ replying to Jesusa

I think vulnerability assessment is also important to identify potential weaknesses.

Evelynn 1 year ago

↳ replying to Jesusa

I agree, business impact analysis is crucial for understanding the risks.

Maryann 1 year ago

I think the vulnerability assessment is the way to go. Gotta know where the weaknesses are before you can start mitigating, right?

Verdell 1 year ago

↳ replying to Maryann

Definitely, vulnerability assessment is crucial for identifying weaknesses.

Ailene 1 year ago

↳ replying to Maryann

I agree, knowing the vulnerabilities is key to improving security.

Skye 1 year ago

↳ replying to Maryann

D) Business impact analysis (BIA)

Dacia 1 year ago

↳ replying to Maryann

C) IT security risk and exposure

Ryan 1 year ago

↳ replying to Maryann

B) Vulnerability assessment

Nicolette 1 year ago

↳ replying to Maryann

A) Capability maturity model

Ligia 1 year ago

Hmm, a capability maturity model sounds like the right approach to me. It's all about assessing the organization's overall security posture, isn't it?

Aron 1 year ago

↳ replying to Ligia

That's also important to consider when determining risk mitigation strategies.

Kenneth 1 year ago

↳ replying to Ligia

C) IT security risk and exposure

Chanel 1 year ago

↳ replying to Ligia

Yes, the capability maturity model helps assess the organization's security readiness.

Ulysses 1 year ago

↳ replying to Ligia

A) Capability maturity model

Olive 2 years ago

That's a good point, but I still think IT security risk and exposure gives a more comprehensive view of the organization's risk posture.

Daniel 2 years ago

I disagree, I believe vulnerability assessment is more important because it helps identify weaknesses that can be exploited by attackers.

Olive 2 years ago

I think the most helpful in determining an organization's current capacity to mitigate risks is IT security risk and exposure.

Isaca CISM Exam - Topic 3 Question 74 Discussion