CISM Practice Questions

The primary objective of a Business Impact Analysis (BIA) is to identify critical business processes and the potential impacts resulting from their disruption. This analysis provides the essential data needed to determine the order in which functions, processes, and their supporting systems must be recovered to minimize operational, financial, and reputational damage. By quantifying the impact of downtime over specific timeframes, the BIA directly establishes the recovery priorities that form the foundation of the entire business continuity and disaster recovery strategy.

B. Defining the recovery point objective (RPO) is a key output derived from the BIA, not its primary objective. The BIA's findings inform what the RPO should be.

C. Confirming control effectiveness is the purpose of a control assessment or security audit, which evaluates the performance of existing safeguards, not the impact of a disruption.

D. Analyzing vulnerabilities is a core activity of a risk assessment, which focuses on identifying weaknesses, whereas a BIA focuses on the consequences of an incident occurring.

1. ISACA

CISM Review Manual

16th Edition. Domain 3: Information Security Program Development and Management

Section 3.4 Business Continuity and Disaster Recovery. The manual states

"The BIA is the process of determining the criticality of business activities and associated resource requirements to ensure operational resilience... The results of the BIA provide the basis for identifying and prioritizing the business processes that must be recovered." This directly supports that determining recovery priorities is the primary goal.

2. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems. In Section 3.2

"Business Impact Analysis

" the document states

"The BIA purpose is to correlate specific system components with the critical services that they provide

and based on that information

to characterize the consequences for the organization if a given component is not available... The BIA helps to identify and prioritize critical IT systems and components."

3. Herbane

B. (2010). The evolution of business continuity management: A historical review of practices and drivers. Business History

52(6)

978-1002. https://doi.org/10.1080/00076791.2010.511185. This academic review discusses the BIA as the "cornerstone of the BCM process

" emphasizing its role in identifying critical activities and their interdependencies to "prioritise the allocation of resources for recovery." (p. 986).

The most important and strategic function of an information security manager on a change management committee is to provide expert advice on the security risks associated with proposed changes. This proactive role ensures that potential vulnerabilities, threats, and impacts on the organization's security posture are identified and evaluated before a change is approved and implemented. By advising on risk, the manager enables the committee to make informed decisions, ensuring that changes align with the organization's risk appetite and that appropriate controls are integrated. This function encompasses other activities like policy updates or testing requirements, but its core is risk advisory.

A. Identifying changes to the information security policy is a potential outcome of a risk assessment, not the primary reason for participation.

B. While ensuring security testing occurs is important, it is a specific control activity derived from the broader risk assessment process.

C. Ensuring proper documentation is a general change management responsibility, not the most critical, specialized contribution of the security manager.

1. ISACA

CISM Review Manual

15th Edition. In Domain 3: Information Security Program Development and Management

Section 3.4.6

"Integration of Security into Processes

" it is stated that "The information security manager should ensure that information security is represented in the change management process to ensure that security risk is managed." This highlights risk management as the central purpose.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The management objective BAI06 Managed Changes includes key practices such as BAI06.03

which is to "Evaluate

prioritize and authorize change requests." A critical part of this evaluation is assessing the "potential impact on security

" which directly aligns with the security manager's role in advising on change-related risk.

3. Kissel

R.

et al. (2013). NIST Special Publication 800-100

Information Security Handbook: A Guide for Managers. Chapter 11

"Configuration Management

" emphasizes that a key security consideration within the change control process is the "security impact analysis" (Section 11.5.2). This analysis is a core risk advisory function performed by information security personnel.

Information security policies are the highest-level internal documents that define an organization's security program. Their primary purpose is to support and enable the organization's mission and objectives. Therefore, the business strategy, which outlines these objectives, risk appetite, and overall direction, must be the most significant influence. Aligning security policies with the business strategy ensures that security initiatives are relevant, receive executive support, and contribute directly to the organization's success rather than being a purely technical or compliance-driven exercise.

B. Past and current threats: These are tactical inputs for risk assessments and control selection, which are guided by policy, not the primary drivers of the policy itself.

C. IT security framework: A framework (e.g., ISO 27001, NIST CSF) provides a structure to implement and manage the security program; it is a tool to execute the strategy, not the source of it.

D. Industry standards: These offer valuable baselines and best practices but must be tailored to the specific context, risk tolerance, and goals defined by the organization's business strategy.

---

1. ISACA

CISM Review Manual

16th Edition.

Domain 1: Information Security Governance

Section 1.4.1

Policy: "The information security policy is a high-level document that must be supported and approved by senior management. It should be driven by business objectives and state management’s commitment to information security." This explicitly states that policy is driven by business objectives

which are a core component of business strategy.

Domain 1: Information Security Governance

Section 1.3.1

Information Security Strategy Objectives: "The information security strategy must be aligned with the business strategy to support the organization’s business objectives." Since policy is a key component for implementing the strategy

it must also be aligned.

2. ISACA

COBIT 2019 Framework: Introduction and Methodology.

Section 3.2

The COBIT Goals Cascade: This core concept illustrates that governance and management objectives are derived from a cascade that begins with "Stakeholder Drivers and Needs

" which are translated into "Enterprise Goals." This demonstrates the principle that all governance activities

including policy creation

must trace back to and support the primary business strategy and goals.

3. Von Solms

B.

& Von Solms

R. (2004). The 10 deadly sins of information security management. Computers & Security

23(5)

371-376.

DOI: https://doi.org/10.1016/j.cose.2004.05.002

This foundational academic paper emphasizes that information security must be managed from the top down

driven by business needs. The failure to create a comprehensive security policy that is aligned with business objectives is cited as a critical mistake

reinforcing that business strategy is the paramount influence.

An information security program's success is fundamentally measured by its ability to support and enable the organization's business objectives. The information security strategy is the formal document that translates business goals into security goals and objectives. Therefore, aligning the security program directly with the security strategy ensures that all activities, resource allocations, and initiatives are purposefully directed toward achieving these business-aligned outcomes. This strategic alignment is the most critical factor for gaining executive support, securing necessary funding, and demonstrating the program's value to the enterprise.

A. Best practices are valuable methods for how to implement security controls, but they do not define the strategic goals or business context for the program.

B. Recognized industry frameworks provide structure and guidance; they are tools used to implement the strategy, not the primary objective to align with for success.

C. Information security policies are high-level rules derived from the strategy. The program implements these policies, but its overarching alignment must be with the strategy itself.

1. ISACA. (2016). CISM Review Manual

15th Edition. Domain 1: Information Security Governance

Section 1.2.2 Strategic Alignment

p. 28. The manual states

"The information security program is the vehicle for implementing the strategy

" which establishes the direct and essential link between the two for achieving success.

2. von Solms

S. H.

& von Solms

R. (2004). The 10 deadly sins of information security management. Computers & Security

23(5)

371-376. https://doi.org/10.1016/j.cose.2004.05.002. The authors identify the failure to align security with business objectives as a primary reason for failure

underscoring that the program must be driven by the business-aligned strategy.

3. Abu-Musa

A. A. (2009). Information security governance in Saudi organizations: an empirical study. Information Management & Computer Security

17(3)

226-276. https://doi.org/10.1108/09685220910982640. This study reinforces that effective information security governance

which directs the security program

is contingent upon the strategic alignment of security with the organization's mission and objectives.

A red team exercise provides the most accurate indication of an organization's ability to respond to a cyber attack. It is a full-scope, objective-based adversarial simulation that mimics the tactics, techniques, and procedures (TTPs) of real-world attackers. This type of exercise tests the entire security program, including the effectiveness of the incident response team (the "blue team"), their processes, and the deployed technologies in a realistic, live environment. It moves beyond theoretical evaluation to a practical assessment of detection, response, and coordination capabilities under the pressure of a simulated attack, providing the most comprehensive and accurate feedback.

A. A walk-through is a discussion-based (tabletop) exercise that reviews the plan's content and roles but does not practically test the team's ability to execute it under pressure.

B. A black box penetration test primarily focuses on identifying technical vulnerabilities from an external perspective, not on evaluating the organization's coordinated incident response process.

C. A simulated phishing exercise is a narrow test focused on a single attack vector and user awareness, not the organization's overall capability to respond to a complex cyber attack.

1. ISACA

CISM Review Manual

16th Edition. Domain 4: Information Security Incident Management

Section 4.7

"Testing the Incident Response Plan." The manual describes a continuum of testing methods

from basic plan reviews to full-scale simulations. It emphasizes that simulations

such as red team exercises

provide the highest level of assurance by testing the plan and response capabilities in a realistic

simulated environment.

2. National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-84

Guide to Test

Training

and Exercise Programs for IT Plans and Capabilities. Section 4.3

"Exercises." This guide categorizes exercises by complexity

with full-scale exercises being the most comprehensive. A red team exercise is a type of full-scale exercise that "simulates a real-world event as closely as possible" and is designed to "validate plans and procedures and test the functioning of all response elements."

3. National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations. Control CA-8

"Penetration Testing." The discussion for this control notes that red team exercises are a type of penetration test used to "simulate adversary actions to assess and improve prevention

detection

and response capabilities." This directly links red teaming to the evaluation of response capabilities.

The primary objective of incident triage is to perform an initial assessment of potential security events to categorize and prioritize them. This process involves analyzing incoming data to determine if an event is a true security incident, its severity, and its potential impact on the organization. This categorization is the foundational step that dictates the urgency, the level of response required, and the allocation of resources for all subsequent incident handling phases, such as containment and eradication.

A. Coordination of communications: This is a critical function of the overall incident management process but is not the primary objective of the initial triage phase, which focuses on event analysis.

B. Mitigation of vulnerabilities: This is a corrective action performed during the post-incident or recovery phase to prevent future incidents, not during the initial assessment or triage.

D. Containment of threats: Containment is a distinct and subsequent phase in the incident response lifecycle that occurs only after triage has confirmed an event is an incident requiring action.

1. ISACA

CISM Review Manual

16th Edition. Domain 4: Incident Management

Section 4.3

"Incident Management and Response." The manual states

"The first step in responding to an incident is to determine its scope and impact... This process is often called triage." It further explains that incidents should be "classified based on their potential impact

" directly supporting categorization as the primary goal.

2. National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-61 Rev. 2

"Computer Security Incident Handling Guide." Section 3.2

"Detection and Analysis

" describes the process that follows an initial detection (precursor or indicator). This phase involves analyzing the event to validate it

determine its scope

and prioritize it. This aligns directly with the concept of triage as a categorization and prioritization activity. Paragraph 1 of Section 3.2.2 states

"This information is used to prioritize the incident."

3. Peltier

T. R. (2013). Information Security Risk Analysis

Third Edition. CRC Press. Chapter 11

"Incident Response

" discusses the incident response process. The initial step after detection is consistently identified as analysis and classification (triage)

where the event is categorized to determine its severity and the appropriate level of response. This must occur before containment or eradication actions are planned. (ISBN: 978-1-4665-8669-5)

A successful information security culture is best measured by the behaviors and attitudes of employees throughout the organization. When end users know how to identify and report security incidents, it demonstrates that security awareness training has been effective and that individuals have internalized their role in protecting information assets. This proactive engagement signifies that security is viewed as a shared responsibility, moving beyond a purely technical function to become an integral part of the organizational mindset. This behavioral outcome is a more direct and meaningful indicator of a mature security culture than technical controls or budget allocation.

A. This is an essential technical security practice but reflects the maturity of the security program, not necessarily the organization-wide culture.

C. This describes a fundamental security principle (role-based access control) and is a governance mechanism, not a direct measure of employee mindset or cultural adoption.

D. A sufficient budget is a critical enabler and shows management support, but it does not guarantee that employees have embraced a security-conscious culture.

1. ISACA

CISM Review Manual

15th Edition. In Domain 3: Information Security Program Development and Management

the section on "Security Awareness and Training" states that a key metric for the effectiveness of an awareness program is the "number of security incidents reported by users" (p. 148). The manual emphasizes that the ultimate goal of awareness is to influence behavior and foster a security-positive culture.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The management objective APO07 Managed Human Resources includes the practice APO07.03

which is to "Maintain the skills and competencies of personnel." A key activity is to "Provide security awareness training." The success of this is measured by behavioral changes

such as an increase in the reporting of security issues by staff

indicating a positive security culture.

3. Da Veiga

A.

& Martins

N. (2015). "Improving the information security culture through monitoring and implementation actions illustrated in a case study." Information & Computer Security

23(2)

162-179. This academic paper highlights that assessing information security culture involves measuring employee behavior. It notes that a positive culture is evident when employees "report security incidents and weaknesses" (p. 165)

reinforcing that this action is a key indicator of cultural success. (DOI: https://doi.org/10.1108/ICS-04-2014-0025)

When civil litigation is a goal, the primary concern is the admissibility and integrity of evidence in a court of law. The chain of custody is the chronological documentation showing the seizure, custody, control, transfer, analysis, and disposition of evidence. Establishing and meticulously documenting the chain of custody from the moment evidence is identified is the foundational step. Failure to do so can lead to the evidence being challenged and deemed inadmissible, which would undermine the entire legal proceeding. All other evidence collection and analysis activities are contingent upon this legally required process.

A. contact law enforcement.

This is appropriate for criminal matters, but civil litigation is a dispute between parties and does not necessarily involve a crime requiring law enforcement.

C. capture evidence using standard server-backup utilities.

Standard backup tools are not forensically sound as they can alter metadata (e.g., access times) and do not capture a complete bit-for-bit image, thereby contaminating evidence.

D. reboot affected machines in a secure area to search for evidence.

Rebooting a system destroys all volatile data in RAM, such as running processes and active network connections, which is often critical evidence for an investigation.

---

1. ISACA

CISM Review Manual

15th Edition. Domain 4: Information Security Incident Management

Section 4.5

Evidence Collection and Forensics. The manual states

"The chain of custody must be maintained for all potential evidence... If the chain of custody is broken at any point

the evidence may be rendered inadmissible in a court of law." (p. 238).

2. National Institute of Standards and Technology (NIST) Special Publication 800-86

Guide to Integrating Forensic Techniques into Incident Response. Section 3.3.2

"Chain of Custody

" explicitly states

"A complete chain of custody log is necessary for evidence to be admissible in a court of law. The log should contain information for each piece of evidence

such as item number

description

acquisition and disposition dates and times

and the individuals who handled the evidence." (p. 24).

3. Casey

E. (2011). Digital Evidence and Computer Crime: Forensic Science

Computers

and the Internet (3rd ed.). Academic Press. This is a foundational academic text in digital forensics. Chapter 3

"Legal Aspects of Digital Forensics

" emphasizes that "maintaining a proper chain of custody is essential for the evidence to be admissible in court... The chain of custody demonstrates that the evidence has not been altered or tampered with." (pp. 89-91).

From an information security risk management perspective, the primary value of an asset is determined by its criticality to the business. The most accurate measure of this criticality is the cost or impact to the business if the asset were to become unavailable or be compromised. This includes direct financial loss, reputational damage, loss of customer confidence, regulatory penalties, and operational disruption. This business-centric approach ensures that security resources are prioritized to protect the assets most essential to the organization's mission and objectives, a core principle of information security governance.

A. Cost of replacing the assets is a component of recovery but ignores the often much larger business impact of downtime and data loss.

C. Original cost of the assets minus depreciation is an accounting metric that does not reflect an asset's current operational importance or criticality.

D. Total cost of ownership (TCO) is a financial calculation for procurement and budgeting, not a measure of an asset's value in a risk context.

1. ISACA

CISM Review Manual

16th Edition. Chapter 2: Information Risk Management

Section 2.4

"Information Asset Classification." The manual emphasizes that asset valuation should be based on its criticality and the impact of its loss on the business. The process of a Business Impact Analysis (BIA) is cited as the method to determine these impacts

which directly corresponds to the "business cost when assets are not available."

2. Fenz

S.

& Ekelhart

A. (2011). Formalizing Information Security Risk Assessment. Proceedings of the 2011 ACM Symposium on Applied Computing. (DOI: https://doi.org/10.1145/1982185.1982578). This academic paper discusses risk assessment methodologies

noting on page 1746 that "The value of an asset is determined by the damage that is caused if a security goal... is violated." This damage is a direct measure of business cost.

3. National Institute of Standards and Technology (NIST). (2012). Guide for Conducting Risk Assessments (NIST Special Publication 800-30

Revision 1). Section 2.3

"Risk Assessment

" describes the process of determining the adverse impact of events. Page 13

Table D-3

provides examples of impact levels (Low

Moderate

High) based on the magnitude of harm to "organizational operations

organizational assets

or individuals

" which is a formal way of expressing the business cost.

Strong senior management support is the most critical factor in fostering staff acceptance of information security policies. This "tone at the top" establishes information security as a core organizational value and a business priority. When leadership visibly champions, funds, and enforces security policies, it creates a culture where compliance is expected and valued. This commitment demonstrates that policies are not merely bureaucratic hurdles but are essential for the organization's success and stability, which is the most powerful driver for employee buy-in and adherence.

B. Computer-based training: Training is essential for awareness and understanding of policies, but without management emphasis, it can be treated as a compliance checkbox rather than leading to genuine acceptance.

C. A robust incident response program: This is a reactive measure that addresses policy failures or breaches. It does not proactively influence the initial acceptance of the policies themselves.

D. Adequate security funding: While necessary to implement controls and programs, funding is a resource. It does not, in itself, shape employee attitudes or guarantee their acceptance of security policies.

1. ISACA

CISM Review Manual

15th Edition. Domain 1: Information Security Governance

Section 1.2.3

"Outcomes of Information Security Governance." The manual emphasizes that the most critical element for a successful information security program is senior management commitment. This commitment ensures that security is integrated into the organizational culture

which directly drives the acceptance and enforcement of policies.

2. von Solms

B.

& von Solms

R. (2004). The 10 deadly sins of information security management. Computers & Security

23(5)

371-376. https://doi.org/10.1016/j.cose.2004.05.002. This academic paper identifies the lack of top management commitment as the "first deadly sin

" stating that without it

"the information security function will never be able to implement and maintain a lasting information security culture

" which is a prerequisite for policy acceptance.

3. D'Arcy

J.

Hovav

A.

& Galletta

D. (2009). User Awareness of Security Countermeasures and Its Impact on Information System Misuse: A Deterrence Theory Perspective. Information Systems Research

20(1)

79-98. This research supports the principle that organizational commitment

demonstrated through management support and the certainty of sanctions for non-compliance

is a key driver for employees to adhere to security policies.