Isaca Updated CISM Exam Questions and Answers by michaela

Clear roles and responsibilities (D) are the most significant contributor to effective incident response during a major breach. CISM emphasizes that confusion over authority, decision-making, or responsibilities severely hinders response effectiveness. While testing (B), documentation (C), and alignment with DR (A) are important, clearly defined roles ensure rapid, coordinated action under pressure.

The first step is to include information security criteria as part of vendor selection (D). CISM third-party risk management guidance stresses that security requirements must be defined before contracting or performance measurement. Contracts (A), reports (B), and metrics (C) are ineffective if the vendor was not selected based on the organization’s security needs. Embedding security criteria early ensures only vendors capable of meeting required controls, compliance, and risk thresholds are considered.

The correct answer is D because adequate funding demonstrates that senior management is actively supporting the information security strategy with the resources required for implementation and sustainability. A strategy cannot be effective unless it is backed by budget, staffing, tools, training, governance support, and operational capability. Key performance indicators help measure progress, but they do not by themselves prove management commitment. A comprehensive awareness program is valuable, but it may exist without broad strategic support. An efficient incident response program is important, but it represents one part of the overall security program. In CISM, senior management commitment is reflected through sponsorship, direction, resource allocation, accountability, and continuous support. Funding is especially important because it enables security initiatives to be executed and maintained over time. Without adequate resources, even a well-designed strategy may fail. Therefore, adequate funding for the information security program is the best indicator of ongoing senior management commitment.

“A successful security program requires management support and involvement. One of the key aspects of management support is to decide on the value of assets and the acceptable level of risk for them. This will help define the security objectives and priorities for the program. The other options are possible activities within a security program, but they are not as important as management decision on asset value.”