Isaca Updated CISM Exam Questions and Answers by alaiya

 Security requirements should be defined concurrently with other requirements to ensure that security is built into the software development process from the beginning and not added as an afterthought. This will also improve the efficiency of the development process by reducing the need for rework and testing. Security requirements should be based on the business objectives, risk assessment, and security policies of the organization, not on code review, security assessment tools, or functional requirements. References = CISM Review Manual 15th Edition, page 1241; CISM Item Development Guide, page 62

The correct answer is C because implementing every control recommended by a security framework without considering business risk, cost, value, and applicability may lead to excessive spending and negative return on investment. Security frameworks provide useful guidance, but they are not intended to be applied blindly. Controls should be selected based on the organization’s risk profile, regulatory requirements, business objectives, risk appetite, and cost-benefit considerations. Increased implementation time is possible, but it is not the greatest concern if controls are justified by risk. Lack of senior management approval is a governance issue, but the deeper concern is that unnecessary controls may consume resources without reducing meaningful risk. Increased risk levels are unlikely to result directly from implementing more controls, although poorly implemented controls can create operational issues. In CISM, information security programs should deliver value by managing risk cost-effectively. Implementing all framework controls may waste resources and reduce program efficiency. Therefore, negative return on investment is the greatest concern.

= According to the CISM Manual1, risk is defined as the combination of the probability of an event and its consequence. Therefore, determining the risk for a particular threat/vulnerability pair before controls are applied can be expressed as a function of the likelihood and impact, should a threat exploit a vulnerability. Likelihood is the probability or frequency of a threat occurring, while impact is the magnitude or severity of the harm or loss that would result from a threat exploiting a vulnerability. The higher the likelihood and impact, the higher the risk. The lower the likelihood and impact, the lower the risk.

The other options are not correct because they do not capture the full expression of risk. Option B only considers the impact, but not the likelihood, of a threat exploiting a vulnerability. Option C confuses the risk with the risk response, which is the action taken to reduce or mitigate the risk. Option D only considers the likelihood, but not the impact, of a threat attempting to exploit a vulnerability.

References = CISM Manual1, Chapter 2: Information Risk Management (IRM), Section 2.1: Risk Concepts2

1: https://store.isaca.org/s/store#/store/browse/cat/a2D4w00000Ac6NNEAZ/tiles 2: 2