Which of the following is MOST important for an information security manager to consider when reviewing a security investment plan?

The correct answer is D. The plan is based on a review of threats and vulnerabilities. A security investment plan should be driven by a risk-based approach, meaning it must be aligned with the organization’s specific threats and vulnerabilities. This ensures that resources are allocated effectively to address the most critical security risks. While costs, best…

Submitted by tom_us· Apr 18, 2026Information Security Risk Management

Question

Options

AThe plan has summarized IT costs for implementation.
BThe plan resolves all potential threats to business processes.
CThe plan focuses on meeting industry best practices and industry standards.
DThe plan is based on a review of threats and vulnerabilities.

How the community answered

(26 responses)

A
15% (4)
B
8% (2)
C
4% (1)
D
73% (19)

Explanation

A security investment plan should be driven by a risk-based approach, meaning it must be aligned with the organization’s specific threats and vulnerabilities. This ensures that resources are allocated effectively to address the most critical security risks. While costs, best practices, and industry standards are important, they should be considered in the context of actual threats and vulnerabilities to maximize security effectiveness.

Topics

#Security Investment#Risk Management#Threat Assessment#Vulnerability Assessment

Community Discussion

No community discussion yet for this question.

Full CISM Practice