Discuss Isaca CISM Exam Topic 7 Question 30

Which of the following is the BEST evidence of the maturity of an organization's information security program?

AIT security staff implements strict technical security controls.

BThe number of reported incidents has increased

CManagement has approved the information security policy.

DThe number of reported incidents has decreased

Suggested Answer: C

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

12 comments · newest first

Brande 11 months ago

Agreed, fewer incidents definitely indicates improvement!

Naomi 12 months ago

Wait, how can more incidents mean better security? That seems off.

Hyun 12 months ago

Management approval of policies is key for a mature program.

Reuben 12 months ago

I think a decrease in incidents shows real progress!

Ludivina 1 year ago

Strict controls are important, but not the only sign of maturity.

Willodean 1 year ago

I recall that an increase in reported incidents could mean better detection, but it doesn't seem like a sign of maturity. I think I lean towards option D being the best evidence.

Sherell 1 year ago

I feel like strict technical controls are necessary, but they don't necessarily reflect the overall maturity of the program. I’m a bit confused about this one.

Reena 1 year ago

I think I came across a similar question where they emphasized management's role in approving policies. It might be important, but is it the best indicator?

Billye 1 year ago

I remember studying that a decrease in reported incidents usually indicates a mature security program, but I'm not entirely sure if that's the best evidence.

Stephanie 1 year ago

I think I'll go with option D - creating a roll-up summary field. That seems like the most straightforward way to display the number of open cases related to the account.

Melissia 1 year ago

This seems straightforward enough. I'll carefully consider each transaction and apply my knowledge of the OFAC regulations to determine the correct answer.

Gwenn 1 year ago

Okay, I think I've got this. The PE router is the provider edge router, so it should connect to at least one other PE router, not a CE (customer edge) device. I'll go with option C.

Isaca CISM Exam - Topic 7 Question 30 Discussion