Which of the following is the BEST indication of an effective information security program?

The correct answer is A. Risk is treated to an acceptable level. The best indication of an effective information security program is that risks are managed to an acceptable level based on the organization's risk appetite. This ensures that security efforts are aligned with business objectives, compliance requirements, and threat landscapes…

Submitted by eva_at· Apr 18, 2026Information Security Program Development and Management

Question

Options

ARisk is treated to an acceptable level.
BPolicies are reviewed and approved by senior management.
CKey risk indicators (KRIs) are established.
DThe number of security incidents reported by staff has increased.

How the community answered

(45 responses)

A
60% (27)
B
22% (10)
C
13% (6)
D
4% (2)

Explanation

The best indication of an effective information security program is that risks are managed to an acceptable level based on the organization's risk appetite. This ensures that security efforts are aligned with business objectives, compliance requirements, and threat landscapes. While policy reviews, KRIs, and increased incident reporting are valuable, they do not directly measure the overall effectiveness of the security program like proper risk treatment does.

Topics

#Information Security Program Effectiveness#Risk Acceptance#Program Goals

Community Discussion

No community discussion yet for this question.

Full CISM Practice