Ace Your CISM Isaca Certification Exam

Retaining communications ensures the organization can produce evidence for litigation or regulatory investigations, which is often a legal obligation.

“Organizations must retain electronic communications to support legal discovery, compliance audits, and investigative needs.”

— CISM Review Manual 15th Edition, Chapter 1: Information Security Governance, Section: Legal and Regulatory Requirements*

The process manager is the person who is responsible for overseeing and managing the business processes and functions that are essential for the organization’s operations and objectives. The process manager has the most direct and detailed knowledge of the inputs, outputs, dependencies, resources, and performance indicators of the business processes and functions. Therefore, the process manager is in the best position to evaluate the business impacts of a disruption or an incident that affects the availability, integrity, or confidentiality of the information assets and systems that support the business processes and functions. The process manager can identify and quantify the potential losses, damages, or consequences that could result from the disruption or incident, such as revenue loss, customer dissatisfaction, regulatory non-compliance, reputational harm, or legal liability. The process manager can also provide input and feedback to the information security manager and the senior management on the business continuity and disaster recovery plans, the risk assessment and treatment, and the security controls and measures that are needed to protect and recover the business processes and functions. References = CISM Review Manual 15th Edition, page 2301; CISM Practice Quiz, question 1302

The program goals are communicated and understood by the organization is the most important factor for the effective implementation of an information security governance program because it ensures that the program is aligned with the business objectives and supported by the stakeholders. Employees receive customized information security training is not the most important factor, but rather a means to achieve the program goals and raise awareness among the staff. The program budget is approved and monitored by senior management is not the most important factor, but rather a resource to enable the program activities and measure its performance. Information security roles and responsibilities are documented is not the most important factor, but rather a way to define and assign the program tasks and accountabilities. References:

The correct answer is C because information security risk management is most effectively aligned with business objectives when it is integrated into the organization’s broader governance and enterprise risk management framework. This ensures security risks are evaluated alongside strategic, operational, financial, legal, and compliance risks. It also enables consistent risk appetite, reporting, ownership, escalation, and decision-making across the enterprise. Mandating ERM policy enforcement may support consistency, but enforcement alone does not ensure that information security risk is properly governed and integrated. Implementing multiple layers of technical controls may reduce some risks, but technical controls alone may not align with business priorities or risk appetite. Annual training is useful for awareness, but it is not sufficient to align risk management with business objectives. CISM emphasizes governance, business alignment, risk ownership, and integration with enterprise risk processes. Therefore, establishing an information security governance framework integrated with ERM is the best answer.