MENU
Which of the following is the BEST indication of an effective information security program?
Suggested Answer: A
Get Premium CISM Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Comprehensive and Detailed Step-by-Step Explanation:
An effective information security program aims to manage risks to acceptable levels while supporting business objectives.
A . Risk is treated to an acceptable level: This is the BEST answer as it directly reflects the program's success in mitigating risks within the organization's tolerance levels.
B . The number of security incidents reported by staff has increased: An increase in reported incidents might indicate improved awareness but does not necessarily reflect overall effectiveness.
C . Key risk indicators (KRIs) are established: KRIs are important for monitoring risks but do not indicate whether risks are being effectively managed.
D . Policies are reviewed and approved by senior management: While essential, this action alone does not demonstrate the program's effectiveness.
29 comments · newest first
MO
Mozelle
10 months ago
Wait, how can we treat risk to an "acceptable level"? What does that even mean?
LA
Lakeesha
11 months ago
D sounds good, but are the policies actually enforced?
KI
Kirk
11 months ago
B seems counterintuitive. More incidents reported doesn't mean it's effective!
GI
Gilma
11 months ago
I think C is important too, though. KRIs help track progress.
SO
Sonia
11 months ago
A is definitely the best choice. Risk management is key!
DE
Deangelo
12 months ago
Reviewing policies by senior management sounds like a good practice, but I wonder if that alone is enough to indicate the overall effectiveness of the program.
ST
Stefany
12 months ago
I feel like establishing key risk indicators is important, but I can't recall if they are the best measure of effectiveness compared to the other options.
ME
Melda
12 months ago
I think the increase in reported incidents might actually suggest that employees are more aware of security issues, but it doesn't necessarily mean the program is effective.
TI
Tish
1 year ago
I remember discussing how treating risk to an acceptable level is crucial for an effective security program, but I'm not sure if that's the best indication.
NO
Noel
1 year ago
I like the idea of looking at key risk indicators as a sign of an effective program. That shows they're actively monitoring and managing the risks. I might go with C on this one.
AL
Alpha
1 year ago
I'm a bit confused by the options. Wouldn't an increase in reported security incidents actually be a bad sign, not a good one? That's what I'm leaning away from.
KI
King
1 year ago
I'm pretty confident that the best answer is A - risk being treated to an acceptable level. That's really the core goal of an effective security program, isn't it?
FR
Franchesca
1 year ago
This seems like a tricky question. I'll need to think carefully about the different options and what they really mean for an effective information security program.
SH
Sherita
2 years ago
Wow, these choices are quite the security buffet. I'll take one of each, please!
JI
Jina
2 years ago
Hmm, I'm not sure. Shouldn't the number of incidents be going down if the program is effective? B seems counterintuitive to me.
AV
Avery
2 years ago
I'm going with D. If senior management is approving the policies, that's a good sign the program is on the right track.
DO
Dorian
2 years ago
I agree, having senior management involved is crucial for a strong information security program.
AL
Alesia
2 years ago
D) Policies are reviewed and approved by senior management.
WE
Wenona
2 years ago
C) Key risk indicators (KRIs) are established.
JE
Jeannetta
2 years ago
A) Risk is treated to an acceptable level.
KI
Kiley
2 years ago
I disagree, I think C is the correct answer. Key risk indicators are crucial for measuring the program's effectiveness.
ED
Edelmira
2 years ago
C) Key risk indicators (KRIs) are established.
JU
Julene
2 years ago
A) Risk is treated to an acceptable level.
CA
Cassi
2 years ago
I believe C) Key risk indicators (KRIs) are established is also important. It helps in monitoring and measuring risks.
SH
Shayne
2 years ago
The best indication of an effective information security program is definitely A. Risk being treated to an acceptable level. That's the whole point, isn't it?
FA
Fannie
2 years ago
C) Key risk indicators (KRIs) are established.
BA
Barrett
2 years ago
A) Risk is treated to an acceptable level.
RO
Rodolfo
2 years ago
I agree with Raina. If risks are managed well, then the information security program is effective.
RA
Raina
2 years ago
I think the best indication is A) Risk is treated to an acceptable level.