MENU
Which of the following would be MOST important to include in a proposal justifying investments for an organization's information security program?
Suggested Answer: D
Get Premium CISM Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Comprehensive and Detailed Step-by-Step Explanation:
Justifying investments in information security requires aligning proposals with business objectives to gain management approval.
A . Vulnerability scan results: These provide technical insights but are insufficient for high-level justification.
B . Competitor benchmark analysis: While useful, this is less relevant than demonstrating direct alignment with organizational needs.
C . Previous security budget: Historical data may provide context but does not justify future needs.
D . Business requirements: This is the BEST answer because aligning security investments with business objectives demonstrates the value and necessity of the program to stakeholders.
29 comments · newest first
TO
Toshia
10 months ago
I agree, business requirements should lead the way!
SH
Shonda
11 months ago
Surprised that competitor analysis isn't a top choice!
ME
Merilyn
11 months ago
Previous security budget? Not really relevant anymore.
CO
Corazon
11 months ago
I think business requirements are way more important.
MA
Margot
11 months ago
Definitely need those vulnerability scan results!
AL
Alona
12 months ago
Competitor benchmark analysis could be useful, but I feel like it’s more about understanding the market rather than justifying specific investments.
EV
Eve
12 months ago
I remember a practice question where previous security budgets were mentioned, but I feel like they might not be as relevant as business requirements in this case.
DI
Dino
12 months ago
I'm not sure if vulnerability scan results are the most important. They show current issues, but do they really justify the investment?
GA
Galen
1 year ago
I think business requirements are crucial because they align security investments with organizational goals, right?
NA
Nancey
1 year ago
Business requirements are definitely key. You need to tie the security investments back to how they'll enable the organization to achieve its objectives.
AL
Alpha
1 year ago
I think the competitor benchmark analysis would be a good way to show how the organization's security measures stack up against the industry. That could help make a strong case.
FR
Freeman
1 year ago
Hmm, I'm not sure. The vulnerability scan results could be really important to justify the need for security improvements. I'll have to think about this one.
HU
Huey
1 year ago
This seems straightforward - I'd focus on the business requirements and how the security investments will support the organization's goals.
TO
Tonette
2 years ago
D) Business requirements, for sure. Can't protect what you don't understand. Although, maybe throw in some cat pics to really seal the deal. Security folks love cats, right?
HO
Howard
2 years ago
D) Business requirements
LA
Lajuana
2 years ago
A) Vulnerability scan results
BE
Beth
2 years ago
I'm going with B) Competitor benchmark analysis. Gotta stay ahead of the competition, even in security!
PE
Peggie
2 years ago
I still think business requirements should take precedence, as they align the security investments with the organization's goals.
HO
Howard
2 years ago
That's a good point, Vicky. Vulnerability scan results can demonstrate the current risks and vulnerabilities.
KA
Kandis
2 years ago
I'd say A) Vulnerability scan results. Showing the actual risks you're facing is key to justifying the investment.
VI
Vicky
2 years ago
But wouldn't vulnerability scan results also be important to show the need for investment in security?
PE
Peggie
2 years ago
I agree with Howard, business requirements are crucial for justifying investments.
VA
Vanna
2 years ago
Definitely D) Business requirements. That's the foundation for any security program. Gotta know what you're protecting, right?
LE
Leanora
2 years ago
Definitely D) Business requirements. That's the foundation for any security program. Gotta know what you're protecting, right?
JA
Jani
2 years ago
D) Business requirements
YA
Yan
2 years ago
C) Previous security budget
KA
Kattie
2 years ago
B) Competitor benchmark analysis
SA
Salena
2 years ago
A) Vulnerability scan results
HO
Howard
2 years ago
I think the most important thing to include would be business requirements.