Exam CISM topic 1 question 552 discussion

If the threat is big enough to realign the strategy, then it should be realigned. Potential impact of threat realization seems to be the correct choice here. for example, until ten years ago, there was no ransomware attacks and when it realized, a lot of companies had to re-evaluate and re-align their security strategies.

I'm gonna go ahead and select B here, since A does not say "business strategy" or "information security strategy", but "IT strategy" alignment. So I feel explaining the impact of threat realization is more important than IT strategy. Information security strategy informs IT strategy, not the other way around.

Since un doing something new or including a new control it has to be aligned with the syrategy ofcourse this is how senior management will even hear you out

B. Potential impact of threat realization While all of the options listed are relevant and important, assessing the potential impact of threat realization should take precedence. Understanding the potential consequences and harm that can result from these threats is essential for making a strong business case for security investments. This information helps the organization assess the risk and prioritize security initiatives effectively. It allows decision-makers to weigh the potential costs and damages associated with not addressing the threats against the investment required for mitigation. Ultimately, the potential impact of threat realization is a critical factor in demonstrating the urgency and necessity of the security initiative.

The strategic context that demonstrates the need for the initiative and how the investment aligns with the organization’s broader strategic goals

B. Potential impact of threat realization

I would go with A