Isaca Updated CISM Exam Questions and Answers by nyra

The primary reason to assign a risk owner in an organization is to ensure accountability for the risk and its treatment. A risk owner is a person or entity that has the authority and responsibility to manage a specific risk and to implement the appropriate risk response actions. By assigning a risk owner, the organization can ensure that the risk is monitored, reported, and controlled in accordance with the organization’s risk appetite and tolerance.

The most important reason to have documented security procedures is to guide the implementation of policy requirements . In CISM governance, policies define management’s high-level expectations, standards define mandatory minimum requirements, and procedures provide the step-by-step instructions needed to execute those requirements consistently. Without documented procedures, employees and operational teams may interpret policy requirements differently, resulting in inconsistent control implementation and increased risk. Metrics reporting, regulatory support, and demonstrating alignment with business objectives are useful secondary benefits, but they are not the primary purpose of procedures. Procedures operationalize governance by translating policy intent into repeatable actions, enabling accountability, consistency, and effective control execution. CISM emphasizes that an effective information security framework requires a clear hierarchy of policies, standards, procedures, and guidelines to ensure management direction is implemented across the organization. Therefore, documented procedures are essential because they tell personnel how to perform required security activities in alignment with approved policies.

The best way to ensure the effective execution of a disaster recovery plan (DRP) is to make sure that the procedures are available at both the primary and the failover location, so that the staff can access them in case of a disaster. The procedures should be clear, concise, and updated regularly to reflect the current situation and requirements. Having the procedures available at both locations also helps to avoid confusion and delays in the recovery process.

References = CISM Review Manual, 16th Edition eBook1, Chapter 9: Business Continuity and Disaster Recovery, Section: Disaster Recovery Planning, Subsection: Disaster Recovery Plan Development, Page 373.

A business impact analysis (BIA) is a process that identifies and evaluates the potential effects of disruptions to critical business operations as a result of a disaster, accident or emergency. The primary purpose of a BIA is to determine the criticality of information assets and the impact of their unavailability on the organization’s mission, objectives and reputation. (From CISM Review Manual 15th Edition)