What Best Facilitates Developing Information Security Procedures?
Short answer
B Classify information assets to determine the exact sensitivity and criticality required for tailoring effective security procedures.
Question
Key Takeaways
Tests understanding of the policy-to-procedure hierarchy, where candidates often mistakenly prioritize generic industry standards over foundational asset classification.
This CISM question tests whether asset classification or external benchmarks better drive procedure development. While debated by candidates, ISACA guidelines confirm that classifying information assets provides the necessary context to design targeted, policy-aligned security procedures.
Common mistake: Option A (Aligning procedures with industry best practices) is frequently chosen because benchmarks seem practical, but they lack the organization-specific context needed to tailor procedures to actual classified assets.
Expert Analysis
Why the Answer Is Correct
Asset classification establishes the value and sensitivity of data, which directly dictates the rigor and scope of required security procedures. ISACA’s governance framework emphasizes that procedures must be proportionate to asset criticality to effectively operationalize high-level policies. Without classification, controls become either misaligned or inefficiently resource-heavy.
Why the Other Options Are Wrong
Industry best practices (A) and external benchmarking (D) provide useful references but cannot replace organization-specific risk context. Considering systemic risk events (C) addresses enterprise-wide threats rather than guiding granular procedure drafting. These options support strategy but do not directly facilitate procedure development like asset classification does.
Community Comment Notes
Candidates are split between A and B, reflecting real-world confusion between standardized frameworks and internal governance. Commenters supporting A highlight the appeal of proven external standards, while those backing B correctly note that classification drives tailored implementation. This mirrors typical exam traps where practical-sounding answers override ISACA’s policy-first methodology.
Exam Strategy
Always trace back to ISACA’s governance hierarchy: policies set direction, asset classification defines requirements, and procedures execute them. When choosing between external benchmarks and internal context, prioritize the option that enables organization-specific control design.
Frequently Asked Questions
Why isn't aligning with industry best practices better here?
Does asset classification come before or after risk assessment?
Community Votes
54% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
ElDirec 👍 6 Answered AIn simple words, it’s like saying, “Let’s look at what the top players in our field are doing for their security, and let’s do that too because it seems to work well for them.” I hope this helps! If you have any more questions, feel free to ask.
-
Booict 👍 4A - Industry best practices provide proven guidelines and standards for implementing effective security procedures. However for B, it focuses on identifying the sensitivity of data rather than directly facilitating procedure development
-
bronay 👍 7 Answered BB. Classification
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CISM Questions
Access 400 questions with complete answers and detailed explanations.
View Full CISM Practice Test →