nerdexam
(ISC)2

CGRC · Question #716

What tools is MOST appropriate to assess whether information security governance objectives are being met? Response:

The correct answer is A. Balanced scorecard. A BSC is most effective for evaluating the degree to which information. A Balanced Scorecard (BSC) is the most appropriate tool to evaluate if information security governance objectives are being met by providing a comprehensive, multi-perspective view of performance.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

What tools is MOST appropriate to assess whether information security governance objectives are being met? Response:

Options

  • ABalanced scorecard. A BSC is most effective for evaluating the degree to which information
  • BBalanced scorecard. A BSC is most effective for disconnecting the degree to which information
  • CBalanced scorecard. A BSC is most uneffective for evaluating the degree to which information
  • DBalanced scorecard. A BSS is most uneffective for disconnecting the degree to which information

How the community answered

(51 responses)
  • A
    76% (39)
  • B
    12% (6)
  • C
    4% (2)
  • D
    8% (4)

Why each option

A Balanced Scorecard (BSC) is the most appropriate tool to evaluate if information security governance objectives are being met by providing a comprehensive, multi-perspective view of performance.

ABalanced scorecard. A BSC is most effective for evaluating the degree to which informationCorrect

A Balanced Scorecard (BSC) is highly effective for evaluating information security governance objectives because it provides a holistic view of performance across various perspectives, including financial, customer, internal business processes, and learning and growth, aligning security metrics with strategic goals. It allows organizations to measure and manage security effectiveness beyond mere technical controls, integrating it into overall business performance.

BBalanced scorecard. A BSC is most effective for disconnecting the degree to which information

The term 'disconnecting' is incorrect; a BSC aims to connect security performance with objectives.

CBalanced scorecard. A BSC is most uneffective for evaluating the degree to which information

Stating that a BSC is 'uneffective' contradicts its established use for performance evaluation.

DBalanced scorecard. A BSS is most uneffective for disconnecting the degree to which information

'BSS' is not the correct acronym, and 'uneffective' and 'disconnecting' are incorrect descriptions.

Concept tested: Information security governance tools

Source: https://www.isaca.org/resources/isaca-journal/2009-archives/volume-3/the-balanced-scorecard-an-effective-tool-for-information-security-management

Topics

#Balanced Scorecard#Governance assessment#Performance measurement#Security governance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice