CISM Information Security Governance — 40 Questions

Question 1

During a security policy development lifecycle, which step should occur immediately after 'drafting' the policy?

Accepted Answer

Legal review. After a policy is drafted, the immediate next step is legal review to ensure the policy complies with applicable laws, regulations, and contractual obligations. This is critical because policies often impose mandatory requirements, and legal counsel must verify that they do not conflict with legal constraints or create unintended liabilities. Only after legal clearance should the policy proceed to broader stakeholder consultation and formal approval.

Answer

Gap analysis

Answer

Training

Answer

Stakeholder consultation

Question 2

A security manager is conducting a regulatory compliance review. Which THREE regulations are most likely to apply to a financial services company operating in the United States?

Accepted Answer

SOX (Sarbanes-Oxley Act). SOX (B) is correct because the Sarbanes-Oxley Act imposes mandatory financial reporting, internal control, and IT audit/record-retention requirements on publicly traded U.S. companies, which squarely covers a U.S. financial services firm. PCI DSS (C) is correct because any financial services company that stores, processes, or transmits cardholder data (e.g., credit/debit card payments) must comply with the Payment Card Industry Data Security Standard. Sector-specific regulations such as SEC cybersecurity rules (D) are correct because U.S. financial institutions are directly regulated by agencies like the SEC, FINRA, and the Federal Reserve, which mandate cybersecurity risk management, incident disclosure, and related controls. HIPAA (A) does not belong because it governs protected health information held by healthcare providers, plans, and clearinghouses, not financial services. GDPR (E) does not belong because it applies to processing of EU residents' personal data by organizations in the EU or targeting EU data subjects, not specifically to a U.S.-operating financial services company.

Answer

HIPAA (Health Insurance Portability and Accountability Act)

Answer

GDPR (General Data Protection Regulation)

Question 3

Which capability maturity model (CMM) level indicates that security processes are managed and measured using quantitative metrics?

Accepted Answer

Level 4: Managed. Level 4 (Managed) is characterized by quantitative management of processes.

Answer

Level 3: Defined

Answer

Level 2: Repeatable

Answer

Level 5: Optimizing

Question 4

An organization is updating its security policies. After drafting the policy, which step should occur NEXT?

Accepted Answer

Legal review. After a policy is drafted, the next step in the policy lifecycle is legal review to ensure the policy does not conflict with laws, regulations, contracts, or other binding obligations before it is submitted for management approval. Legal review is a prerequisite to approval because management must sign off on a document that is legally sound. Only after legal clearance should the policy go to management for formal approval.

Answer

Stakeholder consultation

Answer

Training and awareness

Answer

Approval by management

Question 5

A CISO is designing a security metrics program for the board. Which TWO metrics are MOST appropriate for board-level reporting?

Accepted Answer

Security investment vs. loss avoidance. Option D (Security investment vs. loss avoidance) is correct because it expresses security spending in financial, risk-adjusted terms that directly map to the board's fiduciary concerns about cost-benefit and return on security investment, enabling governance decisions on budget allocation. Option E (Mean time to respond, MTTR) is correct because it is a strategic resilience indicator showing how quickly the organization contains and recovers from incidents, which boards use to gauge operational risk exposure and the effectiveness of the security program. The unmarked options do not belong at board level: A (phishing simulation click rate) and B (average patch deployment time) are tactical/operational metrics better suited to security managers and operational teams, and C (number of firewall rules) is a low-level technical configuration count with no meaningful risk or business context for executive governance.

Answer

Phishing simulation click rate

Answer

Average patch deployment time

Answer

Number of firewall rules

Question 6

A CISO reports to the CIO and provides regular security updates to the board audit committee. The CEO has delegated security accountability to the CFO. Which governance structure does this reflect?

Accepted Answer

Hybrid with executive accountability. The structure is hybrid because security accountability is delegated to the CFO (executive accountability) while the CISO reports to the CIO and briefs the board audit committee — a mix of centralized reporting and distributed executive ownership. This reflects a hybrid governance model where accountability sits with an executive other than the CISO's direct chain.

Answer

Decentralized with business unit CISO

Answer

Outsourced security management

Answer

Centralized with CISO reporting to CEO

Question 7

What is the first step in the security policy development lifecycle?

Accepted Answer

Gap analysis. Gap analysis is the first step because it establishes the current state of controls, practices, and documentation against a chosen framework or standard, revealing what exists and what is missing. Without knowing the gaps, drafting a policy would be guesswork and could duplicate or contradict existing controls. Legal review, drafting, and stakeholder consultation all depend on the findings of the gap analysis to be relevant and targeted.

Answer

Legal review

Answer

Drafting the policy

Answer

Stakeholder consultation

Question 8

Which of the following is the PRIMARY reason for aligning the information security program with business objectives?

Accepted Answer

To demonstrate the value of security to the business and gain executive support. The primary reason for aligning the information security program with business objectives is to demonstrate the value of security to the business and gain executive support. When security is aligned with business goals, it becomes an enabler rather than a cost center, ensuring that security initiatives are prioritized and funded appropriately.

Answer

To reduce the cost of security operations

Answer

To comply with regulatory requirements

Answer

To ensure security initiatives receive adequate funding

Question 9

In a Capability Maturity Model (CMM) for information security processes, which level is characterized by processes being measured and controlled?

Accepted Answer

Level 4 (Managed). In the Capability Maturity Model (CMM) applied to information security, Level 4 (Managed) is defined as the level where processes are quantitatively measured and controlled using metrics and statistical techniques. Level 4 builds on Level 3's defined processes by adding measurement and control, enabling predictable performance.

Answer

Level 5 (Optimizing)

Answer

Level 2 (Repeatable)

Answer

Level 3 (Defined)

Question 10

An organization is developing a security policy for remote access. According to the policy hierarchy, where should this policy fit?

Accepted Answer

Domain-specific standard. A remote access security policy is a domain-specific standard because it defines mandatory, technology-specific requirements (e.g., VPN, MFA, encryption) for a particular area of the environment, sitting below the enterprise security policy in the hierarchy. Standards are mandatory and support the high-level enterprise policy by specifying how its requirements apply to a given domain. This makes 'domain-specific standard' the correct placement.

Answer

Procedure

Answer

Guideline

Answer

Enterprise security policy

Question 11

Which of the following is the PRIMARY role of the board of directors in information security governance?

Accepted Answer

Providing oversight and ensuring security is aligned with business strategy. The board of directors' primary role in information security governance is to provide oversight and ensure that security is aligned with the organization's business strategy. The board sets the tone at the top, approves the risk appetite, and holds management accountable for executing the security program — but it does not perform operational, policy-writing, or technology-selection tasks. This oversight role ensures security is treated as a strategic business enabler rather than a technical silo.

Answer

Conducting daily security operations

Answer

Developing detailed security policies

Answer

Approving specific security technologies

Question 12

Which of the following is the FIRST step in the security policy development lifecycle?

Accepted Answer

Gap analysis. The first step in the security policy development lifecycle is gap analysis — assessing the current state against requirements, risks, and best practices to identify what the policy must address. Only after understanding the gaps can stakeholders be consulted, the policy drafted, and legal review performed.

Answer

Legal review

Answer

Stakeholder consultation

Answer

Drafting the policy

Question 13

An organization is implementing a policy exception management process. Which THREE elements are essential for effective exception handling? (Select THREE.)

Accepted Answer

Periodic review and renewal of exceptions. Option A (Periodic review and renewal of exceptions) is essential because exceptions grant temporary risk acceptance, and without scheduled re-evaluation they can silently become permanent control gaps; reviews confirm the compensating controls still work and the business need persists. Option C (Automatic expiration of the exception after a defined period) is essential because it enforces a bounded lifetime on the risk acceptance, preventing stale exceptions from lingering indefinitely and forcing re-justification before renewal. Option D (Approval by the CISO or designated authority) is essential because exceptions deviate from mandated policy, so only an accountable, authorized role can formally accept the residual risk on behalf of the organization. Option E (Documentation of the business justification) is essential because it records why the exception is needed, the scope, the risk, and any compensating controls, providing the audit trail and basis for review decisions. Option B (Publicizing the exception to all employees) is not required; exception handling is governed by need-to-know and role-based communication, so broad publicity is unnecessary and could even expose sensitive risk information.

Answer

Publicizing the exception to all employees

Answer

Automatic expiration of the exception after a defined period

Question 14

An organization is implementing a security culture measurement program. Which THREE metrics would BEST indicate a positive security culture?

Accepted Answer

Percentage of employees completing security training. Option A is correct because the percentage of employees completing security training directly measures engagement with and adoption of security awareness, a core leading indicator of a positive security culture. Option B is correct because a declining rate of incidents caused by human error reflects improved security behaviors and reduced risky actions across the workforce, showing the culture is translating into practice. Option D is correct because a high near-miss reporting rate indicates employees feel psychologically safe and are proactively surfacing potential issues before they become incidents, which is a hallmark of a mature security culture. Option C does not belong because time since last security audit measures compliance/audit cadence rather than workforce attitudes or behaviors. Option E does not belong because the raw number of incidents reported to management is a lagging volume metric that can rise or fall for many reasons and does not by itself indicate cultural health.

Answer

Time since last security audit

Answer

Number of security incidents reported to management

Question 15

The board of a multinational bank has directed the CISO to establish a formal information security governance framework. Executive management wants assurance that security activities are aligned with business objectives and that risks are managed effectively. Which of the following is the MOST important first step in establishing this framework?

Accepted Answer

Define information security roles and responsibilities across the organization.. Establishing governance begins with defining roles and responsibilities to ensure accountability and alignment with business objectives. This provides the foundation for policies, risk management, and oversight. Without clear ownership, other initiatives lack direction and enforcement. The board's requirement for assurance is met by a framework that clarifies who is responsible for what, enabling effective risk management and strategic alignment.

Answer

Conduct a comprehensive risk assessment of all information assets.

Answer

Deploy a security information and event management (SIEM) system.

Answer

Implement a security awareness training program for all employees.

Question 16

A CISO is developing a business case for a new security investment. The organization's governance requires that security investments be justified by business value. Which two factors are MOST important to include in the business case? (Choose two.)

Accepted Answer

The reduction in risk exposure and potential financial impact.. The correct answers are the reduction in risk exposure and potential financial impact, and the alignment with regulatory requirements and industry standards. In CISM, security investments must be justified by business value, which includes risk reduction and compliance. These factors resonate with executive management and the board because they directly affect the organization's ability to achieve objectives and avoid penalties. They demonstrate that the investment is strategic, not merely technical.

Answer

The total cost of ownership (TCO) of the security solution over five years.

Answer

The number of security incidents prevented in the last year.

Answer

The technical specifications of the proposed security solution.

Question 17

A global retail company is revising its information security strategy to better align with business goals. The CISO has proposed a new governance model that includes a security steering committee. Which of the following should be the PRIMARY responsibility of this committee?

Accepted Answer

Prioritizing security initiatives based on business risk and strategic alignment.. The primary responsibility of a security steering committee is to provide strategic direction and prioritize security initiatives based on business risk and alignment with organizational goals. This ensures that security investments support business objectives and that resources are allocated effectively. The committee does not engage in operational tasks such as policy approval or technical assessments, which are delegated to appropriate teams.

Answer

Reviewing and approving security policies and standards.

Answer

Managing the daily operations of the security operations center (SOC).

Answer

Conducting technical vulnerability assessments and penetration tests.

Question 18

Which of the following is the PRIMARY responsibility of the board of directors regarding information security governance?

Accepted Answer

Setting the strategic direction and oversight of the security programme. The board of directors is responsible for governance, not operations. Its primary security governance duty is to set the strategic direction for the security programme and provide oversight to ensure it aligns with business objectives and risk appetite. Technical execution is delegated to management and security staff.

Answer

Performing technical vulnerability assessments

Answer

Approving specific security tools and technologies

Answer

Conducting daily security monitoring activities

Question 19

An organization has a decentralized governance model where each business unit manages its own security. What is a key challenge of this model?

Accepted Answer

Inconsistent security policies and controls across units. In a decentralized governance model, each business unit manages its own security, which leads to inconsistent policies, controls, and risk postures across the organization. This fragmentation makes it difficult to enforce enterprise-wide standards, aggregate risk, and demonstrate compliance. The key challenge is the lack of uniformity and coordination, not cost or speed.

Answer

Lower cost due to elimination of central security team

Answer

Rapid decision-making due to fewer layers

Answer

Increased central control and uniformity

Question 20

A CISO is developing a multi-year security roadmap. Which of the following should be the PRIMARY driver for prioritizing initiatives?

Accepted Answer

Alignment with business strategy and risk appetite. The primary driver for prioritizing security initiatives in a multi-year roadmap should be alignment with business strategy and risk appetite. This ensures that security investments support business objectives and address the most significant risks to the organization. Other factors like ease of implementation or cost are secondary considerations that should be evaluated within the context of strategic alignment.

Answer

Ease of implementation

Answer

Availability of new technology

Answer

Cost of the initiative