First Action for Information Security Budget Cuts

CISM By islever Editorial Last updated

Short answer

A Analyze the impact to the information security program.

Question

Senior management has requested a budget cut for the information security program in the coming fiscal year. Which of the following should be the information security manager's FIRST course of action?
  1. Analyze the impact to the information security program. Correct Answer
  2. Advise business unit heads of potential changes to the information security program.
  3. Evaluate cost savings within existing implementations.
  4. Re-prioritize information security implementation and operations.

Key Takeaways

This question tests the governance sequence for responding to resource changes, where the trap is jumping to communication or mitigation before assessing the actual impact on risk.

When facing a budget cut, the information security manager must first analyze the impact on the program's risk posture. Community consensus confirms that assessing implications is required before communicating changes or re-prioritizing resources.

Common mistake: Selecting D (Re-prioritize) is a common error because candidates instinctively want to solve the resource shortage immediately, but analysis is required to inform that re-prioritization.

Expert Analysis

Why the Answer Is Correct

Analyzing the impact is the foundational step in risk management and governance. Before any adjustments can be made to the program, the manager must understand the specific risks introduced by the budget reduction. This analysis provides the data needed to justify the budget or accept the residual risk.

Why the Other Options Are Wrong

Advising business unit heads (B) is premature without knowing the specific impacts. Evaluating cost savings (C) is a mitigation strategy that happens after the impact is known. Re-prioritizing operations (D) is a necessary action, but it cannot be done effectively without first analyzing which areas will suffer most from the cuts.

Community Comment Notes

Community members strongly support A, noting it is the "critical first step." Comments highlight that the manager must assess how the cut affects initiatives and controls to make informed decisions subsequently.

Official Reference

ISACA CISM Review Manual, 2024 (Domain 1: Information Security Governance)

This link opens the official vendor documentation in a new tab.

Exam Strategy

For "First" questions involving changes in resources, always look for the assessment or analysis option. Never select a solution or communication option until the impact on risk has been quantified.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Booict 👍 3
    A - This is the critical first step. The manager must assess how the budget cut affects security initiatives, controls, and risk management. Understanding the impact informs subsequent decisions.
  2. sausageman 👍 3 Answered A
    A. Analyze the impact to the information security program.
  3. helg420 👍 1 Answered A
    going with A on this one. First course of action should be to analyze the impact of such cuts on the program. Following this, the security manager can consider other steps such as evaluating potential cost savings within existing implementations (C), which involves looking for efficiencies or possible reductions that do not compromise objectives.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Best Defense Against DDoS Attacks in Enterprise Networks?

S-grade

When Should a Business Continuity Plan Be Primarily Triggered?

S-grade

Which Approach Best Communicates Security to Senior Management?

S-grade

How to Keep a Business Continuity Plan Current?

S-grade

Practice All CISM Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISM Practice Test →

← Back to CISM Study Guide