1.3. Reflection Checkpoint

Key Takeaways

• Security objectives are a three-way trade-off (confidentiality, integrity, availability) — there is no universal priority order; business context decides.
• CISM tests the mindset of a manager who makes risk visible and owned, not a technician who eliminates every finding unilaterally.
• When two answer choices are both technically valid, the one that reflects business-risk framing and correct ownership is usually the intended "best" answer.
• Escalating a decision to the accountable business owner is very often the right move, even when the security team could technically act alone.

Connecting Forward

Phase 2 puts this manager mindset to work at the level of the whole enterprise: how governance structures, legal obligations, and organizational roles turn "the manager, not the technician" from a mindset into an actual reporting line, policy, and strategy that leadership is accountable for.

Self-Check Questions

• Why can't "maximize security" ever be the right goal for a specific control decision?
• If a business owner and a security manager disagree about whether to accept a risk, whose decision should it ultimately be — and why does CISM insist on that answer?