CISM Leak Questions

If participation in security awareness training is decreasing while incidents are rising, making the training program mandatory for all employees is the best course of action. The CISM Review Manual notes that mandatory training ensures organizational-wide coverage and directly addresses the lack of participation, which is likely contributing to increased incidents.

Chain of custody forms with points of contact are the best way to enable an organization to maintain legally admissible evidence because they document the sequence of control, transfer, and analysis of the evidence, and every person who handled it, the dates and times, and the purpose for each action1. They also ensure the authenticity and integrity of the evidence, and prevent tampering or loss1. Documented processes around forensic records retention are not sufficient to maintain legally admissible evidence because they do not track or verify the handling of the evidence. Robust legal framework with notes of legal actions are not sufficient to maintain legally admissible evidence because they do not record or validate the preservation of the evidence. Forensic personnel training that includes technical actions are not sufficient to maintain legally admissible evidence because they do not account or certify the custody of the evidence.

The most important course of action before engaging law enforcement is to engage legal counsel . In CISM incident management, legal counsel helps ensure that the organization complies with legal obligations, preserves privilege where applicable, understands reporting requirements, and avoids actions that could create additional liability. Cyberattacks may involve privacy laws, contractual notification requirements, regulatory obligations, evidence handling requirements, and possible criminal proceedings. Legal counsel is best positioned to advise whether and how law enforcement should be involved. Encrypting evidence is not the primary concern and could complicate evidence handling if not done properly. Senior management input is important, but legal guidance is essential when external authorities may be involved. Hiring forensic experts may also be necessary, but legal counsel should guide the scope, engagement, evidence handling, and reporting considerations. CISM emphasizes coordinated incident response involving legal, communications, management, and technical teams. Therefore, engaging legal counsel is the most important action when law enforcement involvement is being considered.

The correct answer is A because senior management reviews information security reports to determine whether the security program is achieving its objectives and effectively supporting the organization’s business goals. Reporting provides visibility into program performance, risk trends, incident activity, compliance status, control effectiveness, and progress against security objectives. Ensuring adequate resources is an important management responsibility, but resource decisions should be based on an understanding of program effectiveness and risk. Confirming regular audits is useful, but audits are only one source of assurance. Ensuring risk is managed cost-effectively is also important, but it is a broader outcome of governance and decision-making. The primary purpose of reporting is to give senior management enough information to evaluate whether the program is performing as intended. In CISM governance, reporting enables oversight, accountability, informed decision-making, and alignment between security and enterprise objectives. Therefore, assessing the effectiveness of the security program is the best answer.