The CISO of a large enterprise must present a quarterly security report to the executive committee. The committee is composed of non-technical members who are concerned about budget and risk. Which approach to the report is most effective for this audience?

Provide a detailed technical appendix with all vulnerability scan results and firewall logs, and summarize the key findings in a one-page executive summary.

Present a detailed list of every security control and its configuration status, along with a recommendation to increase the security budget by 50%.

Focus the report on key risk indicators, such as the number of high-risk vulnerabilities, the status of critical security projects, and the number of security incidents, presented in a dashboard format.

Send the full technical report to the committee members in advance and use the meeting to answer questions.

What is the primary goal of a security program communication strategy?

To ensure stakeholders understand and support security initiatives

To publish all security policies publicly

To replace the need for security awareness training

To satisfy regulatory requirements only

Which metric is MOST useful for measuring the effectiveness of a security awareness program?

Time spent on the training platform

Percentage of employees who complete the training

Number of training modules created

What is the primary purpose of collecting feedback from employees after a security training session?

To improve future training content and delivery

To compare with other organizations

To identify employees who need disciplinary action

Certified Information Security Manager

Domain 3Objective 3

Program Communication and External Management CISM Practice Questions (Page 2)

Part of the Domain 3: Information Security Program domain, which accounts for 33% of the CISM exam.

35questions here

7free pages

9concepts

33%of the exam

Questions 6–10

6foundation · easy
Which contractual element is essential to ensure the organization can verify a third-party provider's security controls?
Select an answer first
7application · medium
The CISO of a large enterprise must present a quarterly security report to the executive committee. The committee is composed of non-technical members who are concerned about budget and risk. Which approach to the report is most effective for this audience?
Select an answer first
8foundation · easy
What is the primary goal of a security program communication strategy?
Select an answer first
9foundation · easy
Which metric is MOST useful for measuring the effectiveness of a security awareness program?
Select an answer first
10foundation · easy
What is the primary purpose of collecting feedback from employees after a security training session?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.