Isaca Updated CISM Exam Questions and Answers by maxim

The greatest business benefit of an incident response plan is minimizing the negative impact of disruptive incidents on operations and reputation.

“The primary business objective of an incident response plan is to minimize the impact of incidents on business operations and assets.”

— CISM Review Manual 15th Edition, Chapter 4: Incident Management, Section: Incident Response Plan Objectives*

ISACA practice questions reinforce that limiting impact is the key outcome from a business perspective.

Risk appetite (C) best informs the design of an information security framework because it defines the level of risk the organization is willing to accept in pursuit of its objectives. CISM stresses that security frameworks, policies, and control structures must be aligned with business risk tolerance to avoid over- or under-protection. Audit findings (A) highlight gaps, cost (B) affects feasibility, and available skills (D) influence implementation—but none define the strategic level of protection required. Risk appetite ensures that the framework supports business goals, prioritizes resources appropriately, and provides consistent guidance for decision-making across the organization.

A business case best demonstrates return on investment in risk management when requesting investment in new tools. In CISM, a business case connects the proposed investment to business objectives, risk reduction, cost, benefits, alternatives, and expected value. For a BYOD policy expanded to include wearable technologies, management needs to understand why new tools are required, what risks they reduce, what costs are involved, and how the investment supports acceptable risk levels. A risk assessment is an important input because it identifies and analyzes risks associated with wearable technologies, but it does not itself demonstrate ROI. A risk audit report provides assurance or findings, not the investment justification. A BIA supports continuity planning and impact prioritization, but it is not the best document for presenting investment value. The strategy committee needs a decision-oriented justification. Therefore, the business case is the best answer because it translates security needs and risk reduction into management-level investment rationale.