Exam CISM topic 1 question 365 discussion

Actual exam question from Isaca's CISM

Question #: 365
Topic #: 1

Which of the following is an important criterion for developing effective key risk indicators (KRIs) to monitor information security risk?

A. The indicator should provide a retrospective view of risk impacts and be measured annually
B. The indicator should focus on IT and accurately represent risk variances
C. The indicator should align with key performance indicators (KPIs) and measure root causes of process performance issues
D. The indicator should possess a high correlation with a specific risk and be measured on a regular basis

Show Suggested Answer

Suggested Answer: D 🗳️

by jaiz at March 8, 2023, 2:36 p.m.

Comments

Submit Cancel

oluchecpoint

9 months ago

D. The indicator should possess a high correlation with a specific risk and be measured on a regular basis Developing effective Key Risk Indicators (KRIs) for monitoring information security risk involves selecting indicators that are closely tied to specific risks and measuring them regularly. This approach allows organizations to proactively identify and respond to emerging risks and security threats. Options A, B, and C do not emphasize the importance of specificity, regular measurement, and correlation with risks, which are critical aspects of effective KRIs in the context of information security

upvoted 3 times

...