Which if the following would be the MOST important information to include in a business case for an information security project in a highly regulated industry?

• A.Compliance risk assessment
• B.Critical audit findings
• C.Industry comparison analysis
• D.Number of reported security incidents

Comment: *

Name: *

Email: *

Verification: *

Which would be one of the BEST metrics an information security manager can employ to effectively evaluate the results of a security program?

• A.Number of controls implemented
• B.Percent of control objectives accomplished
• C.Percent of compliance with the security policy
• D.Reduction in the number of reported security incidents

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the MOST important prerequisite for establishing information security management within an organization?

• A.Senior management commitment
• B.Information security framework
• C.Information security organizational structure
• D.Information security policy

Comment: *

Name: *

Email: *

Verification: *

An organization wants to integrate information security into its human resource management processes. Which of the following should be the FIRST step?

• A.Evaluate the cost of information security integration
• B.Assess the business objectives of the processes
• C.Identify information security risk associated with the processes
• D.Benchmark the processes with best practice to identify gaps

Comment: *

Name: *

Email: *

Verification: *

Internal audit has reported a number of information security issues that are not in compliance with regulatory requirements. What should the information security manager do FIRST?

• A.Create a security exception.
• B.Perform a gap analysis to determine needed resources.
• C.Perform a vulnerability assessment.
• D.Assess the risk to business operations.

Comment: *

Name: *

Email: *

Verification: *