Exam CISM topic 1 question 988 discussion

Policies are the statement of management intent and are at the core of governance. Without policies anything the metrics measure would be irrelevant.

Defined security metrics

Defined security metrics.

C. Security policy provisions

Security policy provisions outline the rules and guidelines for ensuring the confidentiality, integrity, and availability of information within an organization. These provisions help establish the overall direction and goals of the information security program. They provide a framework for implementing security controls, defining security metrics, and managing changes in a consistent and controlled manner.

D. Defined security metrics

C. Security policy provisions Establishing security policy provisions is a fundamental requirement for maintaining an effective information security governance framework. Security policies define the organization's approach to managing security and provide guidelines for protecting information and assets. These policies cover various aspects of information security, including data protection, access control, incident response, and compliance requirements. Without clear and well-defined security policy provisions, it is challenging to ensure a consistent and comprehensive approach to information security within an organization.