CISM · Question #53
Which of the following is MOST important to include in an information security framework?
The correct answer is D. Information security risk assessment. An information security framework fundamentally relies on risk assessment to identify threats and vulnerabilities, enabling the selection of appropriate controls and strategies.
Question
Which of the following is MOST important to include in an information security framework?
Options
- AGuidance for designing information security controls
- BInformation security organizational structure
- CIndustry benchmarks of information security metrics
- DInformation security risk assessment
How the community answered
(54 responses)- A4% (2)
- B11% (6)
- C4% (2)
- D81% (44)
Why each option
An information security framework fundamentally relies on risk assessment to identify threats and vulnerabilities, enabling the selection of appropriate controls and strategies.
Guidance for designing controls is important but flows *from* the risk assessment, which dictates what controls are needed.
Organizational structure defines roles but does not, by itself, identify the security needs or how to address them.
Industry benchmarks provide context but do not define the specific security posture or requirements for an individual organization.
An information security risk assessment is foundational because it identifies, analyzes, and evaluates risks to an organization's information assets. This process guides the entire framework by determining what needs protection and to what extent, ensuring that security efforts are focused on the most critical areas.
Concept tested: Foundations of information security frameworks
Source: https://www.nist.gov/cyberframework/risk-management-framework
Topics
Community Discussion
No community discussion yet for this question.