The BEST way for an information security manager to provide senior management with an overview of the organization's information assets and their levels of criticality is to present a summary of:

The correct answer is C. risk assessment results. Risk assessment results are the most comprehensive source for communicating both the inventory of information assets and their relative criticality to senior management. A risk assessment explicitly identifies assets, assigns value or sensitivity levels, evaluates threats and…

Submitted by luis.pe· Apr 18, 2026Information Security Risk Management

Question

The BEST way for an information security manager to provide senior management with an overview of the organization’s information assets and their levels of criticality is to present a summary of:

Options

Ainformation security metrics.
Brecent audit findings.
Crisk assessment results.
Dservice-level noncompliance.

How the community answered

(29 responses)

A
14% (4)
B
10% (3)
C
72% (21)
D
3% (1)

Explanation

Risk assessment results are the most comprehensive source for communicating both the inventory of information assets and their relative criticality to senior management. A risk assessment explicitly identifies assets, assigns value or sensitivity levels, evaluates threats and vulnerabilities, and ranks assets by their importance to the organization. This directly answers the question of 'what assets do we have and how critical are they?' Information security metrics (A) measure control performance, not asset criticality. Audit findings (B) highlight deficiencies rather than providing a structured asset overview. Service-level noncompliance (D) addresses operational performance gaps, not asset value or criticality.

Topics

#Risk Assessment#Asset Criticality#Reporting to Management#Information Security Management

Community Discussion

No community discussion yet for this question.

Full CISM Practice