CISM: Certified Information Security ManagerDemo

By Isaca · Question Mode

QuestionQ533

Information Security Risk Management

What is an information security manager's BEST course of action after discovering that an organization with budget constraints is missing several important security capabilities?

  • A Suggest the deployment of open-source security tools to mitigate identified risks.
  • B Establish a business case to demonstrate return on investment (ROI) of a security tool.
  • C Recommend that the organization avoid the most severe risks.
  • D Review the most recent audit report and request funding to address the most serious finding.
Explanation

A business case that demonstrates a security tool’s return on investment enables management to evaluate security spending against business value and allocate limited funding based on justified risk reduction. This is more strategic than selecting tools solely because they are open source or addressing only a single audit finding.

Community Discussion

No comments yet. Be the first to start the discussion!