- (Topic 3)
Which of the following is the MOST important factor in an organization's selection of a key risk indicator (KRI)?

1. A. Return on investment (ROI)
2. B. Compliance requirements
3. C. Target audience
4. D. Criticality of information

Correct Answer: D
A key risk indicator (KRI) is a metric that provides an early warning of potential exposure to a risk. A KRI should be relevant, measurable, timely, and actionable.
The most important factor in an organization’s selection of a KRI is the criticality of information, which means that the KRI should reflect the value and sensitivity of the information assets that are exposed to the risk. For example, a KRI for data breach risk could be the number of unauthorized access attempts to a database that contains confidential customer data. The criticality of information helps to prioritize the risks and focus on the most significant ones. References: https://www.isaca.org/credentialing/cism https://www.wiley.com/en-us/CISM+Certified+Information+Security+Manager+Study+Guide-p-9781119801948

- (Topic 3)
Which of the following BEST enables the assignment of risk and control ownership?

1. A. Aligning to an industry-recognized control framework
2. B. Adopting a risk management framework
3. C. Obtaining senior management buy-in
4. D. Developing an information security strategy

Correct Answer: C
Obtaining senior management buy-in is the best way to enable the assignment of risk and control ownership because it helps to establish the authority and accountability of the risk and control owners, as well as to provide them with the necessary resources and support to perform their roles. Risk and control ownership refers to the assignment of specific responsibilities and accountabilities for managing risks and controls to individuals or groups within the organization. Obtaining senior management buy-in helps to ensure that risk and control ownership is aligned with the organizational objectives, structure, and culture, as well as to communicate the expectations and benefits of risk and control ownership to all stakeholders. Therefore, obtaining senior management buy-in is the correct answer.
References:
✑ https://www.protechtgroup.com/en-au/blog/risk-control-management
✑ https://www.mckinsey.com/~/media/mckinsey/dotcom/client_service/risk/working%20papers/23_getting_risk_ownership_right.ashx
✑ https://www.linkedin.com/pulse/risk-controls-who-owns-them-david-tattam

- (Topic 2)
Which of the following is the MOST critical factor for information security program success?

1. A. comprehensive risk assessment program for information security
2. B. The information security manager's knowledge of the business
3. C. Security staff with appropriate training and adequate resources
4. D. Ongoing audits and addressing open items

Correct Answer: B
The explanation given in the manual is:
The information security manager’s knowledge of the business is the most critical factor for information security program success because it enables him or her to align security objectives with business goals and communicate effectively with senior management and other stakeholders. The other choices are important elements of an information security program but not as critical as the information security manager’s knowledge of the business.
An information security program is a set of policies, procedures, standards, guidelines, and tools that aim to protect an organization’s information assets from threats and ensure compliance with laws and regulations. An information security manager is a professional who oversees and coordinates the implementation and maintenance of an information security program. An information security manager should have a good understanding of the business environment, culture, strategy, processes, and needs of an organization to ensure that security supports its objectives.

- (Topic 2)
Which of the following is MOST important to include in an incident response plan to ensure incidents are responded to by the appropriate individuals?

1. A. Skills required for the incident response team
2. B. A list of external resources to assist with incidents
3. C. Service level agreements (SLAs)
4. D. A detailed incident notification process

Correct Answer: D
A detailed incident notification process is most important to include in an incident response plan to ensure incidents are responded to by the appropriate individuals. The incident notification process defines the roles and responsibilities of the incident response team members, the escalation procedures, the communication channels, the reporting requirements, and the stakeholders to be informed. The incident notification process helps to ensure that the right people are involved in the incident response, that the incident is handled in a timely and efficient manner, and that the relevant information is shared with the appropriate parties. Skills required for the incident response team, a list of external resources to assist with incidents, and service level agreements (SLAs) are also important elements of an incident response plan, but they are not as critical as the incident notification process. Skills required for the incident response team describe the competencies and qualifications of the team members, but they do not specify who should be notified or involved in the incident response. A list of external resources to assist with incidents provides a directory of external parties that can provide support or expertise in the incident response, but it does not define the criteria or process for engaging them. Service level agreements (SLAs) define the expectations and obligations of the service providers and the service recipients in the incident response, but they do not detail the steps or procedures for notifying or escalating incidents. References = CISM Review Manual, 16th Edition, pages 191-1921; CISM Review Questions, Answers & Explanations Manual, 10th Edition, page 662

- (Topic 2)
Which of the following is the MOST effective way to prevent information security incidents?

1. A. Implementing a security information and event management (SIEM) tool
2. B. Implementing a security awareness training program for employees
3. C. Deploying a consistent incident response approach
4. D. Deploying intrusion detection tools in the network environment

Correct Answer: B
The most effective way to prevent information security incidents is to implement a security awareness training program for employees. Security awareness training provides employees with the knowledge and skills they need to identify potential security threats and protect their systems from unauthorized access and malicious activity. Security awareness training also helps to ensure that employees understand their roles and responsibilities when it comes to information security, and can help to reduce the risk of information security incidents by making employees more aware of potential risks. Additionally, implementing a security information and event management (SIEM) tool, deploying a consistent incident response approach, and deploying intrusion detection tools in the network environment can also help to reduce the risk of security incidents