Isaca Certification CISM Syllabus Exam Questions Answers

A risk analysis is the next step to identify and evaluate the potential security risks associated with a third-party service provider and determine the appropriate risk response strategies. References = CISM Review Manual, 16th Edition, Domain 2: Information Risk Management, Chapter 2: Risk Identification, p. 97-981; Chapter 3: Risk Assessment, p. 109-1101; Chapter 4: Risk Response, p. 123-1241

The correct answer is C because an incident response team can limit impact most effectively when it understands the organization’s operational requirements, including critical systems, business priorities, dependencies, acceptable downtime, data sensitivity, and service restoration needs. Incident response decisions often require balancing containment with business continuity. For example, disconnecting a system may stop an attack but could also interrupt critical operations. Understanding operational requirements enables the team to choose response actions that reduce security impact while minimizing disruption to essential business activities. Senior management’s understanding of risk appetite is important for governance, but the response team needs practical operational knowledge during incidents. Training completion trends are useful for program monitoring, but they do not directly guide impact-limiting decisions during an event. Funding supports capability, but it is not the most immediate consideration during response. CISM incident management emphasizes business impact reduction, coordinated response, prioritization, and restoration of critical services. Therefore, understanding operational requirements is the most important consideration for limiting incident impact.

The first thing that the information security manager should do after reading about a vendor product compromise on social media is to validate the risk to the organization. This means verifying the source and credibility of the information, determining if the organization uses the affected product, and assessing the potential impact and likelihood of the compromise on the organization’s data and systems. Validating the risk to the organization will help the information security manager to decide on the appropriate course of action, such as activating the incident response program, notifying relevant stakeholders, or performing a BIA.