Which of the following is the BEST approach for an information security manager when developing new information security policies?

The correct answer is B. Reference a relevant industry security standard. Industry security standards (such as ISO/IEC 27001, NIST SP 800-53, or CIS Controls) provide established, proven frameworks that encode best practices. Referencing them ensures policies are comprehensive, defensible, and aligned with widely accepted security principles. A BIA…

Submitted by mateo_ar· Apr 18, 2026Information Security Program Development and Management

Question

Options

AConduct a business impact analysis (BIA).
BReference a relevant industry security standard.
CEstablish security baselines.
DCreate a stakeholder map.

How the community answered

(54 responses)

A
2% (1)
B
81% (44)
C
6% (3)
D
11% (6)

Explanation

Industry security standards (such as ISO/IEC 27001, NIST SP 800-53, or CIS Controls) provide established, proven frameworks that encode best practices. Referencing them ensures policies are comprehensive, defensible, and aligned with widely accepted security principles. A BIA focuses on business continuity, not policy development. Security baselines and stakeholder maps are useful but are downstream activities - policies should first be grounded in recognized standards before being tailored to organizational context.

Topics

#Policy Development#Information Security Policies#Industry Standards#Security Frameworks

Community Discussion

No community discussion yet for this question.

Full CISM Practice