Isaca Updated CISM Exam Questions and Answers by karter

Risk treatment should be prioritized based on risk criticality. Addressing the most severe and likely risks first ensures that resources are focused where they can have the greatest impact.

“Risk treatment efforts should focus on the most significant risks first, based on likelihood and impact.”

— CISM Review Manual 15th Edition, Chapter 2: Risk Management, Section: Risk Treatment Options*

The best way to ensure continuous compliance with security requirements is to conduct periodic reviews of the vendor’s third-party accredited assessments (B). From a CISM governance and third-party risk management perspective, ongoing assurance is critical when business-critical functions are outsourced. Independent third-party assessments (such as SOC reports or equivalent accredited reviews) provide objective, repeatable, and evidence-based validation that security controls are not only defined but are operating effectively over time.

Training programs (A) improve awareness but do not provide assurance of compliance. Establishing right-to-audit clauses (C) is an important contractual safeguard, but it is typically reactive or periodic, not a continuous monitoring mechanism. Re-approving contract clauses (D) ensures contractual relevance but does not validate actual control effectiveness.

CISM emphasizes that continuous vendor compliance is best achieved through independent assurance mechanisms integrated into ongoing vendor oversight, enabling management to monitor control effectiveness, identify emerging risks, and take timely corrective action. Periodic review of accredited third-party assessments supports governance transparency, accountability, and alignment with the organization’s risk appetite.

 The information security manager should first evaluate the information security laws that apply to the acquired company, as they may differ from the laws of the parent organization. This will help the information security manager to understand the legal and regulatory requirements, risks, and challenges that the acquired company faces in its operating environment. The information security manager can then determine the best approach to align the information security programs of the two entities, taking into account the different laws and regulations, as well as the business objectives and strategies of the acquisition. References = : CISM Review Manual 15th Edition, page 32.

Evacuation drills provide real-time validation of physical security measures, staff preparedness, and response time during fire-related scenarios. They test both people and systems.

“Simulated exercises are the most effective method to evaluate real-world preparedness and the adequacy of response procedures.”

— CISM Review Manual 15th Edition, Chapter 3: Security Controls Testing*

Paper reviews and awareness are useful, but only exercises reveal actual gaps in preparedness.