Exam CISM topic 1 question 644 discussion

In simple words organization’s information security strategy is something that's tailored based on where the org wants to be (a.k.a risk apetite) audits results are based on complaince.

Correct answer is A: Internal security audit. Because it allows the security manager to systematically evaluate whether the strategy is holistic, risk-aligned, and effectively implemented.

So many of you have selected Audits here. Not sure how you can audit a strategy.

C. External security audit An external security audit involves an independent examination of an organization's information security policies, processes, and controls by an external entity. This audit assesses the organization's adherence to established standards and best practices, helping to determine the comprehensiveness of the information security strategy. External audits provide an objective perspective and can identify areas for improvement, potential vulnerabilities, and gaps in the security strategy that may not be apparent in internal assessments. While internal security audits (Option A) and other assessments are valuable, an external audit adds an extra layer of validation and objectivity to the evaluation process.

Straight from multiple professional pentesters mouth. A company will almost always pass an internal audit either that be them knowing they are lying or on accident. For the most compressive dive into a businesses security a 3rd party audit needs to be performed.

How is internal audit better than independent (external) audit? Prove this to me. Answer is C

Option C

C. External security audit

Answer B: Because a Risk Appetite will decide how comprehensive the Security Strategy should be. Risk Appetite drive security strategy.

A. Internal security audit

Seeing as the question is asking for BEST method to get 'comprehensiveness'. I would go with an 3rd party independent audit of the InfoSec program. Which in this case is Option C. Organization risk appetite can give a good understanding of the program but complete details I don't think so.

Internal audit

I guess B

comprehensive understanding is provided by external audit.