CISM Information Security Programme Practice Question
A CISO is deciding on the organizational structure for the information security team. Which reporting structure is most likely to ensure the security function has sufficient independence and authority?
⚠ Common exam trap
ISACA often tests the misconception that reporting to the CIO is acceptable because IT and security are closely related, but the CISM exam emphasizes that independence from IT is critical to avoid conflicts of interest in risk management decisions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reporting to the CEO or board of directors
Reporting to the CEO or board of directors ensures the information security function operates independently from operational and IT management, preventing conflicts of interest where security decisions could be overridden by cost or performance pressures. This structure aligns with the CISM principle that the CISO must have sufficient authority to enforce security policies across the entire organization without reporting to a function that may prioritize other objectives over security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reporting to the Chief Information Officer (CIO)
Why it's wrong here
This may create a conflict of interest as IT operations might prioritize functionality over security.
- ✗
Reporting to the Chief Operating Officer (COO)
Why it's wrong here
The COO focuses on operations, not necessarily on security governance.
- ✗
Reporting to the Chief Financial Officer (CFO)
Why it's wrong here
The CFO focuses on financial management, not security independence.
- ✓
Reporting to the CEO or board of directors
Why this is correct
This structure provides independence from IT and operations, enhancing authority and objectivity.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.