Isaca Updated CISM Exam Questions and Answers by camille

Continuous monitoring is the most effective way to identify changes in an information security environment, as it provides ongoing awareness of the security status, vulnerabilities, and threats that may affect the organization’s information assets and risk posture. Continuous monitoring also helps to evaluate the performance and effectiveness of the security controls and processes, and to detect and respond to any deviations or incidents in a timely manner. (From CISM Review Manual 15th Edition and NIST Special Publication 800-1371)

The correct answer is C because procedures describe specific operational steps for carrying out security requirements, and operational units are the groups that must execute those steps in practice. Procedures must be realistic, workable, and aligned with day-to-day business and technical processes. Involving operational units helps ensure that procedures reflect actual workflows, system dependencies, resource constraints, and control responsibilities. Audit management may review procedures for compliance or control adequacy, but auditors should not be the primary developers of operational procedures. Senior management approves direction and policy, but it usually does not define detailed procedural steps. End users may provide useful feedback for procedures affecting them, but operational units have the strongest understanding of how processes are performed and controlled. In CISM, effective security program management requires translating policies and standards into practical procedures that can be implemented consistently. Therefore, operational units are the most important group to involve in procedure development.

 = The information security manager should contact the information owner after the incident has been confirmed, as this is the first step of the incident response process. The information owner is the person who has the authority and responsibility for the information asset that is affected by the incident. The information owner needs to be informed of the incident as soon as possible, as they may have to make decisions or take actions regarding the protection, recovery, or restoration of the information asset. The information owner may also have to communicate with other stakeholders, such as the business units, customers, regulators, or media, depending on the nature and impact of the incident.

The other options are not the correct time to contact the information owner, as they occur later in the incident response process. Contacting the information owner after the incident has been contained, mitigated, or logged may delay the notification and escalation of the incident, as well as the involvement and collaboration of the information owner. Moreover, contacting the information owner after the incident has been contained or mitigated may imply that the incident response team has already taken actions that may affect the information asset without the consent or approval of the information owner. Contacting the information owner after a potential incident has been logged may cause unnecessary alarm or confusion, as the potential incident may not be a real or significant incident, or it may not affect the information owner’s asset. References =

CISM Review Manual, 16th Edition, ISACA, 2022, pp. 219-220, 226-227.

CISM Questions, Answers & Explanations Database, ISACA, 2022, QID 1009.