Passed Exam Today CISM

= A supply chain attack is a type of cyberattack that targets the suppliers or service providers of an organization, rather than the organization itself. The attackers exploit the vulnerabilities or weaknesses in the supply chain to gain access to the organization’s network, systems, or data. The attackers may then use the compromised third-party resources to launch further attacks, steal sensitive information, disrupt operations, or damage reputation. Therefore, the most likely risk scenario that emerges from a supply chain attack is the compromise of critical assets via third-party resources. This scenario poses a high threat to the confidentiality, integrity, and availability of the organization’s assets, as well as its compliance and trustworthiness. Unavailability of services provided by a supplier, loss of customers due to unavailability of products, and unreliable delivery of hardware and software resources by a supplier are all possible consequences of a supply chain attack, but they are not the most likely risk scenarios. These scenarios may affect the organization’s productivity, profitability, and customer satisfaction, but they do not directly compromise the organization’s critical assets. Moreover, these scenarios may be caused by other factors besides a supply chain attack, such as natural disasters, human errors, or market fluctuations. References = CISM Review Manual 2023, page 189 1; CISM Practice Quiz 2

The correct answer is D because a business case for an information security initiative should first be based on risk. Conducting a risk assessment identifies the threats, vulnerabilities, likelihood, business impact, regulatory exposure, control gaps, and potential consequences that justify the initiative. In a highly regulated environment, legal and compliance obligations are important inputs, but the business case should still be driven by risk to the organization, including compliance risk. Benchmarking against competitors may provide context, but it does not define the organization’s specific need. Consulting legal counsel may be necessary to interpret regulatory obligations, but it is not as complete as a risk assessment for developing a business case. A feasibility study is useful after the need and risk have been established. CISM emphasizes that security investments should be risk-based, business-aligned, and cost-justified. Therefore, the first step is to conduct a risk assessment to support the business case.