CISM · Question #959
Which of the following would provide the BEST reference for the initial development of an information security program?
The correct answer is B. Industry-recognized security framework. Industry-recognized security frameworks (such as NIST CSF, ISO/IEC 27001, or COBIT) provide comprehensive, structured, and proven guidance covering governance, risk management, controls, and processes. They are designed specifically as blueprints for building security programs…
Question
Which of the following would provide the BEST reference for the initial development of an information security program?
Options
- AIncident response plan
- BIndustry-recognized security framework
- CDisaster recovery plan (DRP)
- DRecent security audit findings
How the community answered
(39 responses)- B95% (37)
- C3% (1)
- D3% (1)
Explanation
Industry-recognized security frameworks (such as NIST CSF, ISO/IEC 27001, or COBIT) provide comprehensive, structured, and proven guidance covering governance, risk management, controls, and processes. They are designed specifically as blueprints for building security programs from the ground up. An incident response plan (A) and a disaster recovery plan (C) are components of a mature program, not starting references. Recent audit findings (D) are retrospective and organization-specific, lacking the breadth needed as a foundational reference. Frameworks offer the broadest and most authoritative starting point.
Topics
Community Discussion
No community discussion yet for this question.