Isaca Updated CISM Exam Questions and Answers by lee

The correct answer is A because senior management has primary responsibility for ensuring that the organization complies with applicable laws, regulations, contractual obligations, and governance requirements. While compliance tasks may be delegated to legal, risk, compliance, IT, and control owners, accountability remains with senior management. Enterprise risk management may help identify and manage regulatory risk, but it does not replace management accountability. Control owners are responsible for operating specific controls, but they are not accountable for overall regulatory compliance. Legal counsel advises on legal interpretation and obligations, but does not own enterprise compliance accountability. In CISM governance, senior management provides direction, resources, oversight, and accountability for information security and compliance. The information security manager supports this by implementing security programs, reporting risks, and advising on controls. However, the responsibility for ensuring regulatory compliance rests with senior leadership because compliance failures can affect the entire organization, including legal exposure, financial penalties, operational restrictions, and reputational harm.

= After a ransomware incident, the most important concern for the information security manager is to identify the root cause of the incident and prevent it from happening again. The root cause analysis (RCA) is a systematic process of finding and eliminating the underlying factors that led to the incident, such as vulnerabilities, misconfigurations, human errors, or malicious actions. Without performing a RCA, the organization may not be able to address the root cause and may face the same or similar incidents in the future, which could result in more damage, costs, and reputational loss. Therefore, the information security manager should prioritize the RCA over other concerns, such as meeting the SLA, RTO, or notification requirements, which are important but secondary to the RCA.

References = CISM Review Manual 15th Edition, page 254-2551; CISM Review Questions, Answers & Explanations Database - 12 Month Subscription, QID 4202

Inconsistent device security is the primary challenge for an information security manager when deploying a bring your own device (BYOD) mobile program in an enterprise because it increases the risk of data breaches and compromises. A BYOD mobile program allows employees to use their personal devices, such as smartphones, tablets, or laptops, to access the organization’s network, applications, and data. However, personal devices may have different operating systems, versions, configurations, and security settings than the organization’s standard devices. Moreover, personal devices may not be updated regularly, may have unauthorized or malicious apps installed, or may not have adequate protection against malware or theft. Inconsistent device security makes it difficult for the information security manager to enforce and monitor the security policies and controls across all devices, as well as to ensure compliance with the regulatory requirements for data privacy and security. Therefore, inconsistent device security is the correct answer.