Exam CISM topic 1 question 718 discussion

Rank the answers based on their importance for an effective information security governance committee: A. Members represent functions across the organization – Security affects all departments, so having diverse representation ensures a broad, well-rounded approach to governance. This helps align security initiatives with business needs. D. Members are business risk owners – Risk owners ensure accountability and drive security decisions based on business priorities, making them critical stakeholders. B. Members have knowledge of information security controls – While expertise is valuable, security governance is more about strategy and oversight than technical details. C. Members are rotated periodically – Rotation can bring fresh perspectives, but consistency in governance is typically more important for continuity and long-term success.

Answer is D: Members are business risk owners. Because business risk owners are the people who are accountable for outcomes, they can make informed decisions about acceptable risk levels and they can align security initiatives with business priorities and risk appetite.

It's A, it does not have to be that everyone is a business owner.

Between A and D, the answer is A because A could include D but D does not necessarily guarantee A.

Overall understanding is required here so members representing functions from various business units across the organization can provide that.

The most important part of steering committee is to have representatives that cover multiple functions across the organization. If you dont have this then there will be a lack of advocates in certain divisions of the business.

D. Members are business risk owners: Information security is not just an IT issue; it's a business issue. Business leaders who are also risk owners have a deep understanding of the organization's overall objectives, priorities, and risk appetite. When these leaders are involved in the information security governance committee, decisions related to security measures are more likely to align with the broader business strategy, and there is a better chance of achieving a balance between security and business objectives.

A. Members represent functions across the organization

Why not "Members are business risk owners" ?