The Certified Information Security Manager (CISM)

 The information security manager’s best course of action is to present the risk to senior management, because this is a case of conflicting objectives and priorities between the information security team and the business management. The information security manager should explain the potential impact and likelihood of a security breach due to the violation of the access policy, as well as the possible legal, regulatory, and reputational consequences. The information security manager should also provide alternative solutions that can achieve both operational efficiency and security compliance, such as implementing single sign-on, role-based access control, or multi-factor authentication. The information security manager should not enforce the policy without senior management’s approval, because this could cause operational disruption and business dissatisfaction. The information security manager should not modify the policy without a proper risk assessment and approval process, because this could weaken the security posture and expose the organization to more threats. The information security manager should not create an exception for the deviation without a formal risk acceptance and documentation process, because this could create inconsistency and ambiguity in the policy enforcement and accountability. References = CISM Review Manual, 16th Edition, ISACA, 2021, pages 127-128, 138-139, 143-144.

The first step should be to identify all information assets in the legacy environment . Managing security risk during data transfer requires understanding what data and information assets exist before evaluating impact, assigning ownership, testing, or selecting controls. CISM risk management emphasizes that asset identification is foundational because organizations cannot protect, classify, transfer, or assign accountability for assets they do not know exist. A business impact analysis may help prioritize critical processes and recovery requirements, but it does not replace the need to identify the data assets being transferred. Security testing of legacy systems may be useful later, especially if the systems remain operational during migration, but it is not the first step. Assigning owners is necessary, but ownership can only be accurately assigned after assets are identified. Unsupported legacy systems often contain undocumented data, obsolete interfaces, and unknown dependencies. Therefore, the first risk management activity must be creating an accurate inventory of information assets in the legacy environment.

The data owner is the most appropriate role to determine access rights for specific users of an application because they have legal rights and complete control over data elements4. They are also responsible for approving data glossaries and definitions, ensuring the accuracy of information, and supervising operations related to data quality5. The data custodian is responsible for the safe custody, transport, and storage of the data and implementation of business rules, but not for determining access rights4. The system administrator is responsible for managing the security and storage infrastructure of data sets according to the organization’s data governance policies, but not for determining access rights5. Senior management is responsible for setting the strategic direction and priorities for data governance, but not for determining access rights5. References: 5 https://www.cpomagazine.com/cyber-security/data-owners-vs-data-stewards-vs-data-custodians-the-3-types-of-data-masters-and-why-you-should-employ-them/ 4 https://cloudgal42.com/data-privacy-difference-between-data-owner-controller-and-data-custodian-processor/

The correct answer is C because information security governance is most effectively implemented when it is integrated into existing enterprise governance structures wherever possible. Using established committees, reporting channels, risk management processes, decision-making bodies, and accountability mechanisms improves adoption and avoids creating isolated or duplicative security governance processes. It also helps ensure that information security is treated as part of enterprise governance rather than as a separate technical function. Gradual change may reduce resistance in some situations, but it is not the best general approach to optimizing governance implementation. Change control processes are useful for managing system or process changes, but they do not optimize the overall governance structure. International standards can provide useful guidance, but implementing standard-based processes without considering the organization’s existing governance model may reduce effectiveness. CISM governance principles emphasize alignment with business objectives, integration with enterprise governance, senior management oversight, and clear accountability. Therefore, utilizing existing governance structures is the best way to optimize implementation.

SIEM systems collect and analyze log data from across the organization, allowing for real-time monitoring, incident correlation, and end-to-end tracking of response activities — including severity classification and closure.

“SIEM tools enable centralized management, prioritization, and documentation of incidents, making them essential for impact tracking and incident lifecycle management.”

— CISM Review Manual 15th Edition, Chapter 4: Incident Management Systems*

While EDR and XDR help detect threats, SIEMs offer the full scope for impact-based tracking.

Business strategy is the overarching driver for any organizational initiative, including security. Information security policies must align with the strategic goals of the organization to ensure relevance, support, and effectiveness.

Security policies that do not consider the business context may hinder operations or fail to protect key objectives. Business-driven policies are more likely to gain executive support and compliance from stakeholders, creating a strong foundation for governance.

“Information security policies must be aligned with business goals and objectives to ensure that they support the overall mission and are embraced by stakeholders.”

— CISM Review Manual 15th Edition, Chapter 1: Information Security Governance, Section: Strategy Alignment*

When introducing new technologies, the first step is to recalculate the risk profile to identify any new or changed risks.

“The implementation of new technologies should trigger a review of the risk profile to identify and address new exposures.”

— CISM Review Manual 15th Edition, Chapter 2: Risk Management, Section: Risk Assessment and Analysis*

Establishing risk metrics best enables an organization to increase information security control effectiveness because metrics provide measurable insight into whether controls are reducing risk as intended. CISM emphasizes that control effectiveness must be monitored using meaningful measurements aligned with risk appetite, business objectives, and key risk indicators. Reviewing implementation progress only confirms whether controls are being deployed; it does not prove that controls are effective. Performing periodic criticality analysis may help prioritize controls, but it does not continuously measure performance. Reassigning ownership may be appropriate when accountability problems exist, but it is reactive and limited to failing areas. Risk metrics enable management to detect control weaknesses, track trends, prioritize improvements, and make informed decisions. They also support continuous improvement by showing whether residual risk is moving toward acceptable levels. Therefore, risk metrics are the best mechanism to increase effectiveness because they connect control performance directly to risk reduction and management objectives.

The most important consideration when establishing metrics for reporting to the information security strategy committee is D. Aligning the metrics with the organizational culture. This is because the metrics should reflect the values, beliefs, and behaviors of the organization and its stakeholders, and support the achievement of the strategic objectives and goals. The metrics should also be relevant, meaningful, and understandable for the intended audience, and provide clear and actionable information for decision making. The metrics should not be too technical, complex, or ambiguous, but rather focus on the key aspects of information security performance, such as risk, compliance, maturity, value, and effectiveness.

References = CISM Review Manual 15th Edition, Chapter 1, Section 1.3.2, page 281; CISM Review Questions, Answers & Explanations Manual 9th Edition, Question 5, page 3