Information Security Management Program ACCISO Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A regional bank is establishing an Information Security Management Program (ISMP) to align with its new business strategy of expanding digital banking services. The board has approved a security budget but insists that the program directly support business objectives and demonstrate value. The CISO is tasked with defining the program's scope and initial components. Which approach best aligns the ISMP with the bank's strategic direction?

   • AImplement a full set of industry-standard security controls across all systems to ensure maximum protection from the outset.
   • BDefer the ISMP until after the digital banking platform is launched, then conduct a post-implementation review to identify security gaps.
   • CStart with a comprehensive risk assessment of all digital banking channels, then select security controls based on the identified risks and business impact.
   • DFocus exclusively on regulatory compliance requirements, as meeting them will satisfy the board's expectation of value.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which phase of risk management involves identifying and evaluating risks to information assets?

   • ARisk communication
   • BRisk assessment
   • CRisk monitoring
   • DRisk treatment
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A hospital is designing its Information Security Management Program. The compliance officer insists that the program must include all regulatory requirements, while the IT director wants to focus on technical controls. The CISO needs to balance both perspectives. What is the most effective way to structure the ISMP?

   • ADevelop a unified ISMP that maps regulatory requirements to technical controls and policies
   • BFocus only on regulatory compliance and let IT handle security separately
   • CCreate separate programs for compliance and technical security
   • DPrioritize technical controls and address compliance only if time permits
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A financial services firm's ISMP includes a metrics program. The CISO needs to report to the board on the effectiveness of the security awareness training. Which metric would best demonstrate the program's impact on reducing human error?

   • ANumber of training sessions completed per quarter
   • BPercentage of employees who pass the annual security quiz
   • CTotal number of security awareness posters displayed in offices
   • DReduction in the rate of employees falling for simulated phishing emails over time
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   An e-commerce company's ISMP includes a set of KPIs. After a year, the CISO notices that the KPIs are not driving improvements. The metrics are collected but not acted upon. Which change would most likely make the metrics effective?

   • AAlign KPIs with business objectives and establish a regular review process where metrics are analyzed and actions are assigned.
   • BCollect more metrics to get a complete picture of the security posture.
   • CReport the KPIs to the board more frequently to increase visibility.
   • DSimplify the KPIs to a single number that is easy to understand.
   Reveal Solution Discussion Select an answer first