Exam CISM topic 1 question 711 discussion

Sorry D.

I would appreciate it, if answer option D would avoid using the word "incident" and use the word "event" instead. An incident is a confirmed security issue (e.g., attack, vulnerability) and incident response must be triggered. Events are cases where the reported matter must be assessed, before declaring an actual incident. In this case, an increase in reported security events demonstrates a heightened user awareness towards security. Hence it's a good indication of an effective awareness program.

B. Reduction in the impact of security incidents D happens naturally but is a bad sign that user report unnecessary case B should be the purpose of the campaign, compare to C

D. For the ones saying that is C, how you gonna know if the decrease of security incidents is simply because there are less attacks or because the awareness training was good? If people report more things is a clear indicator that the awareness was good.

C. Decrease in the number of security incidents........Stop over-analysing these questions. D. is wrong. The correct answer is C.

C. Decrease in the number of security incidents

D. Increase in the number of reported security incidents

According to ISACA, more incidents being reported could be an indicator that the staff is paying more attention to security.

The best indication of the effectiveness of a recent information security awareness campaign delivered across the organization is a decrease in the number of security incidents

Decrease