1. Home
2. All questions
3. Question 150

CISM study material · question 150 of 1000

A security manager argues that justifying funding is the finance function's job, not theirs. How does the CISM job practice treat this?

• Security governance

1. Business case development belongs to the audit function, which already reviews whether past spending achieved its purpose
2. Developing business cases to support security investment is an explicit task of the security manager
3. Funding justification falls outside the four CISM domains and is handled entirely within the finance function instead
4. Business cases are required only for capital purchases

Challenge yourself on this topic → Study as cards