Free CISM Questions Attempt

The next thing that an information security manager should do after creating a roadmap to execute the strategy for an information security program is D. Develop a project plan to implement the strategy. This is because a project plan is a detailed document that outlines the scope, objectives, deliverables, milestones, tasks, resources, roles, responsibilities, risks, and dependencies of the implementation process. A project plan can help the information security manager to organize, coordinate, monitor, and control the activities and resources required to execute the strategy and achieve the desired outcomes. A project plan can also facilitate communication, collaboration, and reporting among the project team, stakeholders, and sponsors.

A project plan is a detailed document that outlines the scope, objectives, deliverables, milestones, tasks, resources, roles, responsibilities, risks, and dependencies of the implementation process. (From CISM Manual or related resources)

References = CISM Review Manual 15th Edition, Chapter 3, Section 3.1.2, page 1281; CISM Review Questions, Answers & Explanations Manual 9th Edition, Question 74, page 19

The information security manager’s first course of action when one of the organization’s critical third-party providers experiences a data breach should be to invoke the incident response plan that has been established for such scenarios. The incident response plan should define the roles and responsibilities, communication channels, escalation procedures, and recovery actions for dealing with a third-party data breach. Invoking the incident response plan will help to contain the impact, assess the damage, coordinate the response, and restore the normal operations as soon as possible.

References = CISM Review Manual, 16th Edition, page 290