Last Attempt CISM Questions

The correct answer is B because an independent assessment provides objective evidence regarding the design and operating effectiveness of a third party’s controls. When a vendor will process customer information, the organization must obtain assurance that the vendor can protect confidentiality, integrity, availability, privacy, and regulatory compliance requirements. Independent assessments, such as third-party audit reports or assurance reviews, are stronger than self-reported information because they are performed by an objective party. Incident response test results may show one aspect of readiness, but they do not provide broad evidence that all required controls operate effectively. An external vulnerability assessment is useful for identifying technical weaknesses, but it is limited in scope. A questionnaire can help gather information during due diligence, but it relies heavily on vendor representations. CISM emphasizes third-party risk management, due diligence, contractual assurance, and ongoing monitoring. Therefore, an independent assessment is the best evidence that the third party’s controls will operate as required.

= After a ransomware incident, the most important concern for the information security manager is to identify the root cause of the incident and prevent it from happening again. The root cause analysis (RCA) is a systematic process of finding and eliminating the underlying factors that led to the incident, such as vulnerabilities, misconfigurations, human errors, or malicious actions. Without performing a RCA, the organization may not be able to address the root cause and may face the same or similar incidents in the future, which could result in more damage, costs, and reputational loss. Therefore, the information security manager should prioritize the RCA over other concerns, such as meeting the SLA, RTO, or notification requirements, which are important but secondary to the RCA.

References = CISM Review Manual 15th Edition, page 254-2551; CISM Review Questions, Answers & Explanations Database - 12 Month Subscription, QID 4202

The correct answer is A because senior management has primary responsibility for ensuring that the organization complies with applicable laws, regulations, contractual obligations, and governance requirements. While compliance tasks may be delegated to legal, risk, compliance, IT, and control owners, accountability remains with senior management. Enterprise risk management may help identify and manage regulatory risk, but it does not replace management accountability. Control owners are responsible for operating specific controls, but they are not accountable for overall regulatory compliance. Legal counsel advises on legal interpretation and obligations, but does not own enterprise compliance accountability. In CISM governance, senior management provides direction, resources, oversight, and accountability for information security and compliance. The information security manager supports this by implementing security programs, reporting risks, and advising on controls. However, the responsibility for ensuring regulatory compliance rests with senior leadership because compliance failures can affect the entire organization, including legal exposure, financial penalties, operational restrictions, and reputational harm.