A new data privacy regulation requires the organization to respond to customer data deletion requests within 30 days. Currently, no single team owns this process. The security team is asked to manage the program. Which of the following is the most critical first step for the security manager?

Ask the legal team to handle the entire process since it is a regulatory requirement.

Define and document the specific roles and responsibilities of the legal, IT, and customer support teams in the deletion process.

Purchase and deploy a new data discovery tool that can automatically find and delete customer data.

Immediately begin deleting data from all systems as requests come in, without a formal process.

When a business unit wants to use a technology that conflicts with security policy, what is the first step in resolving the conflict?

Escalate the issue directly to the CEO

Understand the business need and the security risk

Ignore the conflict and hope it resolves itself

Immediately block the technology to enforce the policy

A security team is struggling to get timely threat intelligence from the IT operations team. The security manager suspects the IT team is overwhelmed and does not understand the value of the information they are being asked to provide. What is the most effective way to improve this communication flow?

Send a strongly worded email to the IT operations manager demanding better cooperation.

Create a formal service-level agreement (SLA) with IT operations that defines the type, frequency, and format of threat intelligence to be shared.

Ask the security team to collect the threat intelligence themselves from external sources instead of relying on IT operations.

Hold a one-time meeting with IT operations to explain the importance of threat intelligence.

Which of the following is a common communication bottleneck in security program management?

Using multiple communication channels for the same message

Communicating security risks in non-technical language

Holding regular status meetings with clear agendas

Over-reliance on technical jargon that non-security stakeholders do not understand

What is the primary purpose of integrating security controls into existing organizational processes?

To replace all manual security checks with automated tools

To make security controls invisible to users

To create a separate security process for each control

To ensure security is consistently applied without disrupting workflows

Information Systems Security Management Professional

Domain 1Objective 9

1.9 Manage Security Programs ISSMP Practice Questions (Page 5)

Part of the Leadership and Organizational Management domain, which accounts for 21% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 2–3 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

6concepts

21%of the exam

Questions 21–25

21application · medium
A new data privacy regulation requires the organization to respond to customer data deletion requests within 30 days. Currently, no single team owns this process. The security team is asked to manage the program. Which of the following is the most critical first step for the security manager?
Select an answer first
22foundation · easy
When a business unit wants to use a technology that conflicts with security policy, what is the first step in resolving the conflict?
Select an answer first
23application · medium
A security team is struggling to get timely threat intelligence from the IT operations team. The security manager suspects the IT team is overwhelmed and does not understand the value of the information they are being asked to provide. What is the most effective way to improve this communication flow?
Select an answer first
24foundation · easy
Which of the following is a common communication bottleneck in security program management?
Select an answer first
25foundation · easy
What is the primary purpose of integrating security controls into existing organizational processes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.