CISM: Certified Information Security ManagerDemo

Information security controls should be risk-based and aligned to the organization’s mission and business risk. Business risk scenarios provide the context for selecting controls that mitigate relevant threats and consequences. Regulatory obligations, vulnerability findings, and BIA results inform that process but are not its sole primary driver. NIST’s Risk Management Framework specifies selecting controls based on risk assessments.