CISM: Certified Information Security Manager

Risk-assessment results should be communicated in business terms so senior management can understand their effect on organizational objectives, make informed decisions, and prioritize resources. Technical details such as formal methodologies, benchmarks, and specific controls are secondary to clear business impact.