A newly appointed information security manager has been asked to update all security-related policies and procedures that have been static for five years or more. What should be done FIRST?

The correct answer is A. Inventory and review current security policies.. The first step is to inventory and review the existing security policies and procedures to understand what currently exists, identify outdated or missing items, and establish the baseline needed before assessing regulatory changes, aligning to best practices, or performing deeper

Submitted by krish.m· Apr 18, 2026Information Security Program Development and Management

Question

Options

AInventory and review current security policies.
BReview legal and regulatory requirements.
CUpdate in accordance with the best business practices.
DPerform a risk assessment of the current IT environment.

How the community answered

(29 responses)

A
83% (24)
C
10% (3)
D
7% (2)

Explanation

The first step is to inventory and review the existing security policies and procedures to understand what currently exists, identify outdated or missing items, and establish the baseline needed before assessing regulatory changes, aligning to best practices, or performing deeper risk-based updates.

Topics

#Policy Management#Security Policies#Policy Lifecycle#Information Security Program

Community Discussion

No community discussion yet for this question.

Full CISM Practice