CISM · Question #115
Which of the following is the MOST important consideration when evaluating the performance of existing security controls?
The correct answer is C. Selecting testing methods that match the purpose of the testing. To effectively evaluate security controls, the testing methods chosen must directly align with the specific goals and objectives of the evaluation.
Question
Which of the following is the MOST important consideration when evaluating the performance of existing security controls?
Options
- AInterviewing control owners to accurately collect metrics data
- BEstablishing testing scenarios based on international standards
- CSelecting testing methods that match the purpose of the testing
- DObtaining senior management support to facilitate testing
How the community answered
(48 responses)- A19% (9)
- B4% (2)
- C71% (34)
- D6% (3)
Why each option
To effectively evaluate security controls, the testing methods chosen must directly align with the specific goals and objectives of the evaluation.
While collecting metrics is important, selecting the right testing method precedes and dictates what metrics can be accurately collected and from whom.
International standards can provide guidance, but blindly following them without considering the specific purpose of the testing might not yield the most relevant results for the organization.
Different evaluation purposes (e.g., compliance, vulnerability assessment, performance measurement) require distinct methodologies and tools to yield relevant and actionable insights. Matching the method to the purpose ensures the evaluation generates meaningful data for informed decision-making regarding control effectiveness.
Senior management support is beneficial for resource allocation and cooperation, but it does not directly influence the technical appropriateness of the testing methodology itself.
Concept tested: Security control evaluation methodology
Topics
Community Discussion
No community discussion yet for this question.