CISM Information Security Governance — 30 Questions

Question 1

A multinational corporation is implementing an information security governance framework. The board has requested a mechanism to ensure that security investments align with business objectives. Which of the following is the BEST approach to achieve this alignment?

Accepted Answer

Develop a risk-based prioritization framework linking security initiatives to business risk appetite.. Option D is correct because a risk-based prioritization framework directly maps security initiatives to the organization's risk appetite, ensuring that investments target the most critical business risks. This aligns with the CISM principle that governance must link security activities to business objectives through risk management, not through arbitrary cost-cutting or blanket compliance.

Answer

Minimize security spending to maximize ROI.

Answer

Adopt a best-practice framework such as NIST CSF and implement all controls.

Answer

Focus on regulatory compliance to ensure legal requirements are met.

Question 2

A newly appointed CISO wants to establish an information security governance committee. What is the PRIMARY purpose of this committee?

Accepted Answer

To ensure security strategy aligns with business objectives and provide oversight.. The primary purpose of an information security governance committee is to ensure that the security strategy aligns with business objectives and to provide oversight. This committee does not execute day-to-day operations or implement controls; instead, it sets direction, reviews risk posture, and ensures that security investments support organizational goals, as defined in frameworks like COBIT and ISO 38500.

Answer

To manage day-to-day security operations.

Answer

To implement security controls across the organization.

Answer

To approve technical security solutions.

Question 3

A financial services firm has a mature information security program but is struggling to demonstrate the value of security investments to the board. Which metric would BEST communicate the effectiveness of the security program in business terms?

Accepted Answer

Reduction in average cost per security incident over the past year.. The reduction in average cost per security incident directly translates security program outcomes into financial terms that resonate with the board. This metric demonstrates the program's effectiveness by quantifying the monetary value of improved prevention, detection, and response capabilities, aligning with the CISM focus on governance and business alignment.

Answer

Number of security alerts triaged per day.

Answer

Time to patch critical vulnerabilities.

Answer

Percentage of systems with endpoint protection installed.

Question 4

During a merger, the acquiring company's CISO must integrate the security governance of the target company. The target company has no formal security governance. What is the FIRST step the CISO should take?

Accepted Answer

Perform a comprehensive risk assessment of the target company's security posture.. Without a formal security governance structure, the CISO must first understand the target company's current security posture through a comprehensive risk assessment. This step identifies vulnerabilities, threats, and gaps in controls, providing the baseline data needed to prioritize integration efforts and align with the acquirer's governance framework. Skipping this assessment risks implementing policies that are irrelevant or ineffective against the target's actual risks.

Answer

Conduct a security awareness training for the target company's employees.

Answer

Align the target company's security policies with the acquirer's policies.

Answer

Implement the acquirer's security governance framework immediately.

Question 5

An organization's security governance committee has approved a new security policy. What is the NEXT critical step to ensure the policy's effectiveness?

Accepted Answer

Communicate the policy to all relevant stakeholders and provide training.. Option B is correct because communication and training are essential for adoption. Option A is wrong because implementation without communication leads to non-compliance. Option C is wrong because auditing before implementation is premature. Option D is wrong because enforcement without understanding is ineffective.

Answer

Implement technical controls to enforce the policy.

Answer

Conduct an audit to measure compliance.

Answer

Enforce disciplinary actions for non-compliance.

Question 6

A healthcare organization is developing an information security strategy. The board has mandated that the strategy must support innovation while protecting patient data. Which governance approach BEST balances these priorities?

Accepted Answer

Establish a risk appetite framework that defines acceptable risk levels for innovation initiatives.. A risk appetite framework (Option B) is the correct governance approach because it explicitly defines the level of risk the organization is willing to accept in pursuit of innovation, allowing the board to balance patient data protection with strategic growth. This framework provides a decision-making boundary for security controls, ensuring that innovation initiatives are not stifled by overly restrictive measures while still maintaining compliance with healthcare regulations like HIPAA and HITECH.

Answer

Implement strict access controls and encryption for all data.

Answer

Adopt a 'security by design' approach for all new projects.

Answer

Create a separate innovation sandbox with limited data access.

Question 7

Which of the following is the PRIMARY role of the board of directors in information security governance?

Accepted Answer

Providing strategic direction and oversight of the security program.. The board of directors holds the ultimate fiduciary responsibility for the organization, including its information security posture. Their primary role is to provide strategic direction and oversight, ensuring that the security program aligns with business objectives, risk appetite, and regulatory requirements. This includes approving the overall security strategy, reviewing key risk indicators, and holding management accountable for security performance, not executing tactical tasks.

Answer

Managing the day-to-day security operations.

Answer

Implementing security controls and technologies.

Answer

Developing detailed security policies and procedures.

Question 8

An organization has a decentralized security governance model. The CISO is struggling to enforce consistent security policies across business units. What is the BEST approach to improve consistency?

Accepted Answer

Establish a central security governance committee with representation from each business unit.. In a decentralized governance model, the best approach to enforce consistent security policies without undermining business unit autonomy is to establish a central security governance committee with representation from each business unit. This federated approach ensures that policies are collaboratively developed, agreed upon, and uniformly applied, leveraging cross-unit input to balance security requirements with operational needs. It directly addresses the CISO's enforcement challenge by creating a formal, inclusive decision-making body that drives policy standardization.

Answer

Allow each business unit to define its own security policies.

Answer

Implement a federated model where business units have complete autonomy.

Answer

Mandate that all business units adopt the same security tools and processes.

Question 9

A company is considering outsourcing its security operations center (SOC). Which governance consideration is MOST critical before finalizing the decision?

Accepted Answer

The ability to maintain oversight and accountability for security outcomes.. Option D is correct because governance requires that the organization retains ultimate responsibility for security outcomes, even when functions are outsourced. Without the ability to maintain oversight and accountability, the company cannot ensure that its security posture aligns with business risk tolerance and regulatory compliance requirements. This is a fundamental principle of information security governance, as the board and senior management cannot delegate accountability.

Answer

The vendor's service level agreements (SLAs) for incident response times.

Answer

The vendor's technical expertise and certifications.

Answer

The cost savings compared to in-house operations.

Question 10

Which TWO of the following are key components of an information security governance framework? (Choose two.)

Accepted Answer

Security policy and standards.. Security policy and standards are foundational components of an information security governance framework because they establish the high-level direction, principles, and mandatory requirements that guide the organization's security posture. The risk management process is equally critical as it provides a structured methodology for identifying, assessing, and treating risks, ensuring that security decisions are aligned with business objectives and risk appetite. Together, they form the strategic and operational backbone of governance, enabling accountability and continuous improvement.

Answer

Intrusion detection system (IDS) configuration.

Answer

Firewall rule set.

Answer

Payment Card Industry Data Security Standard (PCI DSS) compliance report.

Question 11

Which THREE of the following are essential roles in an effective information security governance structure? (Choose three.)

Accepted Answer

Board of directors.. The board of directors is essential because it holds ultimate accountability for the organization's risk posture and must approve the information security strategy, policies, and resource allocation. Without board-level oversight, security governance lacks the authority to enforce compliance and align security objectives with business goals. This aligns with the CISM framework's emphasis on top-down governance, where the board provides strategic direction and ensures adequate funding for security initiatives.

Answer

Help desk manager.

Answer

Network administrator.

Question 12

Which TWO of the following are primary objectives of information security governance? (Choose two.)

Accepted Answer

Align security strategy with business goals.. Option B is correct because information security governance's primary objective is to ensure that security strategy is aligned with business goals, enabling the organization to protect assets while supporting its mission. This alignment is achieved through governance frameworks like COBIT or ISO 38500, which mandate that security investments and controls are directly tied to business objectives, not isolated technical measures.

Answer

Eliminate all information security risks.

Answer

Maximize profitability through security investments.

Answer

Achieve compliance with all applicable regulations.

Question 13

You are the CISO of a mid-sized e-commerce company with 500 employees. The company recently suffered a data breach where an attacker exfiltrated customer credit card data from the production database. The investigation revealed that the breach originated from a compromised developer workstation. The developer had been granted direct access to the production database for troubleshooting purposes, a practice that had been in place for years. The security governance framework currently lacks a formal process for managing privileged access. The board has asked for immediate improvements to prevent recurrence. Which course of action BEST addresses the governance gap?

Accepted Answer

Implement a privileged access management (PAM) solution with just-in-time access and session recording.. The core governance gap is the lack of a formal process for managing privileged access. Implementing a Privileged Access Management (PAM) solution with just-in-time (JIT) access and session recording directly addresses this by enforcing time-bound, auditable, and approved access to the production database, eliminating standing privileges. This aligns with the principle of least privilege and provides a governance mechanism to control, monitor, and revoke elevated access, which is the root cause of the breach.

Answer

Segment the network to isolate production databases from developer workstations.

Answer

Conduct security awareness training for all developers on password security.

Answer

Deploy endpoint protection and patch management for all workstations.

Question 14

You are the IT governance officer at a regional bank with 1,200 employees. The bank has a security policy that requires annual security awareness training for all staff. However, the compliance rate is only 60%. The board is concerned about regulatory risk and wants to improve compliance. The current training is a generic online module that takes 30 minutes to complete. Employees complain that the training is boring and not relevant to their roles. The training is managed by the HR department, which sends reminders but does not enforce consequences. Which of the following is the BEST course of action to improve training compliance and governance?

Accepted Answer

Redesign the training to be role-specific and mandate completion in the security governance framework with consequences for non-compliance.. Option D is correct because it addresses both the root cause (irrelevant training) and the governance gap (lack of enforcement). By redesigning training to be role-specific, employees see direct relevance, which improves engagement and retention. Mandating completion within the security governance framework and attaching consequences (e.g., access revocation) creates accountability, directly driving compliance from 60% toward the board's target.

Answer

Outsource the training to a third-party provider.

Answer

Increase the frequency of reminder emails from monthly to weekly.

Answer

Implement a learning management system (LMS) to track completion.

Question 15

An organization is implementing a new cloud-based ERP system. Which of the following is the MOST important action for the information security manager to ensure alignment with the organization's risk appetite?

Accepted Answer

Conduct a risk assessment to identify and evaluate risks associated with the cloud deployment.. Conducting a risk assessment (A) is the most important action because it directly evaluates the cloud ERP deployment against the organization's risk appetite, identifying, analyzing, and evaluating risks such as data exposure, vendor lock-in, and compliance gaps. This foundational step ensures that subsequent controls, contracts, and policies are aligned with the acceptable level of risk, as defined by the organization's risk tolerance thresholds.

Answer

Review the cloud provider's SOC 2 report for compliance with relevant regulations.

Answer

Negotiate contract terms including data protection clauses with the cloud provider.

Answer

Develop a detailed access control policy specifically for the cloud ERP system.

Question 16

A multinational corporation is designing its information security governance framework. The board has requested a single metric that best indicates the effectiveness of the security program. Which metric would BEST satisfy this request?

Accepted Answer

Percentage of security controls achieving their intended outcomes as validated by testing.. Option D is correct because it provides a direct measure of how well security controls are working. Option A is an operational metric, not strategic. Option B is a compliance metric but does not measure effectiveness. Option C is a technical metric that may not resonate with the board.

Answer

Percentage of systems compliant with security baseline.

Answer

Number of security incidents reported per month.

Answer

Mean time to detect (MTTD) security events.

Question 17

An information security manager is developing a security strategy for a financial institution. Which of the following should be the PRIMARY driver for selecting security controls?

Accepted Answer

Business requirements derived from risk assessment and compliance obligations.. Business requirements derived from risk assessment and compliance obligations are the primary driver because they directly align security controls with the institution's specific risk appetite, regulatory mandates (e.g., PCI DSS, SOX, GDPR), and operational needs. This ensures controls are cost-effective and prioritized based on actual exposure rather than reactive or budget-driven decisions.

Answer

The latest cybersecurity threats reported in the industry.

Answer

Past security incidents that caused significant financial loss.

Answer

The security budget allocated for the fiscal year.

Question 18

During an audit, it was found that the organization's information security policy is not being followed by business units. Which of the following is the MOST effective way for the information security manager to improve compliance?

Accepted Answer

Establish a policy review committee with business unit representatives to align policy with operational needs.. The most effective way to improve compliance is to align the policy with operational realities by involving business unit representatives in a policy review committee. When policies conflict with business processes, users will bypass them; adjusting the policy to be both secure and practical increases voluntary adherence. This addresses the root cause—policy misalignment—rather than treating symptoms like lack of awareness or enforcement.

Answer

Provide additional security awareness training focused on policy requirements.

Answer

Escalate non-compliance to senior management for disciplinary action.

Answer

Increase the frequency of automated policy compliance checks.

Question 19

An organization has decided to adopt a risk-based approach to information security. What is the FIRST step the information security manager should take to implement this approach?

Accepted Answer

Identify and assess information assets and their associated threats and vulnerabilities.. The first step in implementing a risk-based approach is to identify and assess information assets along with their associated threats and vulnerabilities. This foundational activity provides the necessary context for all subsequent risk management decisions, including defining risk appetite, selecting a framework, and implementing controls. Without a clear understanding of what assets exist and what risks they face, any further steps would be based on assumptions rather than evidence.

Answer

Define the organization's risk appetite and risk tolerance levels.

Answer

Implement security controls based on industry best practices.

Answer

Select a risk management framework such as ISO 31000 or NIST RMF.

Question 20

Which TWO of the following are key responsibilities of an information security governance committee?

Accepted Answer

Approve major changes to information security policies.. The information security governance committee is a high-level body responsible for strategic oversight. Approving major changes to information security policies (Option C) is a core governance function, ensuring that policy updates align with business objectives and regulatory requirements before implementation. This is distinct from operational tasks like vulnerability assessments or daily monitoring.

Answer

Perform vulnerability assessments on critical systems.

Answer

Set the organization's risk appetite.

Answer

Conduct daily monitoring of security events.