Online CISM Questions Video

The organization’s risk tolerance is the most important factor to consider when choosing a shared alternate location for computing facilities, because it determines the acceptable level of risk exposure and the required recovery time objectives (RTOs) and recovery point objectives (RPOs) for the organization’s critical business processes and information assets. Resource availability, the organization’s mission, and incident response team training are also important considerations, but they are secondary to the risk tolerance.

References = CISM Review Manual, 16th Edition, page 290

An information security steering committee is a group of senior executives and managers from different business units and functions who provide strategic direction, oversight, and support for the information security program. The most important function of the committee is to obtain multiple perspectives from the business, as this helps to ensure that the information security program aligns with the business goals, needs, and culture, and that the security decisions reflect the interests and expectations of the stakeholders.

References = CISM Review Manual 2022, page 331; CISM Exam Content Outline, Domain 1, Knowledge Statement 1.22; Improve Security Governance With a Security Steering Committee2; The Role of the Corporate Information Security Steering Committee3

This outcome indicates that the employees are more aware of the signs and techniques of social engineering and are able to report them to the appropriate authorities. This also helps to prevent successful attacks and reduce the impact of potential breaches.

References: The CISM Review Manual 2023 states that “security awareness training should include information on how to identify and report social engineering attempts” and that “the effectiveness of security awareness training can be measured by the number and quality of reported incidents” (p. 121). The CISM Review Questions, Answers & Explanations Manual 2023 also provides the following rationale for this answer: “An increase in reported social engineering attempts is the best indicator that the security awareness training program has been effective, as it shows that the employees are more vigilant and proactive in detecting and reporting such attempts” (p. 45).