Free Access Isaca CISM New Release

According to the CISM Review Manual, 15th Edition1, the information security manager is responsible for ensuring that the information security program supports the organization’s objectives and aligns with applicable laws and regulations. The information security manager is also responsible for overseeing the implementation and maintenance of effective IT controls, as well as monitoring and reporting on their performance.

References = 1: CISM Review Manual, 15th Edition, ISACA, 2016, Chapter 1, page 10.

The correct answer is C because before migrating a human resources application to the cloud, the information security manager should assess the cloud provider’s security capabilities, control environment, compliance posture, data protection practices, incident response process, access management, privacy protections, and contractual commitments. Human resources applications often process sensitive personal and employment information, so third-party and cloud risks must be evaluated before migration. Updating policies may be necessary later, but it does not determine whether the provider can adequately protect the data. Encrypting data is important, but encryption alone does not address all cloud risks such as access control, availability, segregation, monitoring, legal jurisdiction, breach notification, and vendor operations. Conducting vulnerability scans on the cloud provider may not be permitted and would provide only a narrow technical view. CISM emphasizes due diligence and risk assessment when outsourcing or using third-party services. Therefore, a security assessment of the cloud provider is the best way to support the migration securely.

The primary objective of creating a security culture is to reduce risk to acceptable levels (C) by influencing employee behavior and decision-making. CISM stresses that culture is a means to an end—not the end itself. Prioritization (B), resource acquisition (A), and reporting (D) are outcomes or enablers, but the ultimate purpose is effective risk reduction aligned with business objectives. A strong security culture helps prevent incidents, improves compliance, and strengthens resilience through consistent, risk-aware behavior at all levels of the organization.