Isaca CISM Exam - Topic 3 Question 92 Discussion

Actual exam question for Isaca's CISM exam

Question #: 92
Topic #: 3

[All CISM Questions]

Which of the following would be MOST important to include in a proposal justifying investments for an organization's information security program?

AVulnerability scan results

BCompetitor benchmark analysis

CPrevious security budget

DBusiness requirements

Show Suggested Answer

Suggested Answer: D

Comprehensive and Detailed Step-by-Step Explanation:

Justifying investments in information security requires aligning proposals with business objectives to gain management approval.

A . Vulnerability scan results: These provide technical insights but are insufficient for high-level justification.

B . Competitor benchmark analysis: While useful, this is less relevant than demonstrating direct alignment with organizational needs.

C . Previous security budget: Historical data may provide context but does not justify future needs.

D . Business requirements: This is the BEST answer because aligning security investments with business objectives demonstrates the value and necessity of the program to stakeholders.

by Isabella at Jan 28, 2025, 09:50 AM

Limited Time Offer

25%

Off

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Toshia

4 months ago

I agree, business requirements should lead the way!

upvoted 0 times

...

Shonda

5 months ago

Surprised that competitor analysis isn't a top choice!

upvoted 0 times

...

Merilyn

5 months ago

Previous security budget? Not really relevant anymore.

upvoted 0 times

...

Corazon

5 months ago

I think business requirements are way more important.

upvoted 0 times

...

Margot

5 months ago

Definitely need those vulnerability scan results!

upvoted 0 times

...

Alona

5 months ago

Competitor benchmark analysis could be useful, but I feel like it’s more about understanding the market rather than justifying specific investments.

upvoted 0 times

...

Eve

6 months ago

I remember a practice question where previous security budgets were mentioned, but I feel like they might not be as relevant as business requirements in this case.

upvoted 0 times

...

Dino

6 months ago

I'm not sure if vulnerability scan results are the most important. They show current issues, but do they really justify the investment?

upvoted 0 times

...

Galen

6 months ago

I think business requirements are crucial because they align security investments with organizational goals, right?

upvoted 0 times

...

Nancey

6 months ago

Business requirements are definitely key. You need to tie the security investments back to how they'll enable the organization to achieve its objectives.

upvoted 0 times

...

Alpha

6 months ago

I think the competitor benchmark analysis would be a good way to show how the organization's security measures stack up against the industry. That could help make a strong case.

upvoted 0 times

...

Freeman

6 months ago

Hmm, I'm not sure. The vulnerability scan results could be really important to justify the need for security improvements. I'll have to think about this one.

upvoted 0 times

...

Huey

6 months ago

This seems straightforward - I'd focus on the business requirements and how the security investments will support the organization's goals.

upvoted 0 times

...

Tonette

1 year ago

D) Business requirements, for sure. Can't protect what you don't understand. Although, maybe throw in some cat pics to really seal the deal. Security folks love cats, right?

upvoted 0 times