Study. uk . com
  1. Home
  2. All questions
  3. Question 105

CISM study material · question 105 of 1000

An organisation begins the seven-step process for integrating security into capital planning. What is the first step?

  1. Conduct system-level prioritisation of corrective actions
  2. Submit the investment case to the review board
  3. Identify the baseline, using security metrics or other available data to establish current posture
  4. Develop the business case and concept paper
Show the answer

Answer: C. Identify the baseline, using security metrics or other available data to establish current posture

NIST's seven-step process begins by identifying the baseline: using information security metrics or other available data to baseline the organisation's current security posture.

Source: NIST SP 800-100 (NIST) — Sec. 5.2 Integrating Security into CPIC

Challenge yourself on this topic → Study as cards