CISM Information Security Program Practice Question
A CISO is defining the scope of the information security program. The organization has multiple locations and uses cloud services extensively. Which factor is MOST important to consider when defining the program's scope?
⚠ Common exam trap
The trap here is focusing on technology or location factors instead of starting with the business mission and its supporting information assets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The business processes and information assets that support the organization's mission
The most important factor is the business processes and information assets that support the organization's mission. This ensures the security program is aligned with business objectives and covers all critical assets, whether on-premises or in the cloud. By defining scope based on mission-critical processes, the CISO can prioritize risks and allocate resources effectively, ensuring comprehensive protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The business processes and information assets that support the organization's mission
Why this is correct
The scope of the security program should be defined by the business processes and information assets that are critical to the organization's mission. This ensures that security efforts are focused on what matters most to the business, regardless of location or technology. By starting with the mission and identifying supporting assets, the CISO can develop a comprehensive program that addresses risks to those assets, including those in the cloud. This approach aligns security with business objectives and ensures resources are allocated effectively.
- ✗
The geographic locations of the organization's offices
Why it's wrong here
Geographic locations are relevant for regulatory and legal considerations, but they are not the most important factor. The scope should encompass all information assets and processes, including those in the cloud, which may not be tied to a physical location. Prioritizing geography could result in an incomplete scope that misses cloud-based risks. The CISO should define scope based on business processes, information assets, and risk, taking geography into account as one of several factors.
- ✗
The number of employees at each location
Why it's wrong here
While employee count can influence resource allocation, it is not the primary factor for defining scope. The scope should be based on where information assets reside and the risks to those assets, regardless of the number of employees. Focusing on employee count could lead to overlooking critical assets in locations with fewer staff or in cloud environments. The CISO should instead consider the full lifecycle of information and the associated risks across all locations and services.
- ✗
The specific cloud service providers used by the organization
Why it's wrong here
Cloud service providers are part of the technology landscape, but they do not define the scope of the security program. The scope should be based on business needs and information assets, not on the vendors that host them. Focusing on providers could lead to a technology-centric scope that misses other critical assets. The CISO should instead identify all information assets and processes, including those in the cloud, and then apply appropriate controls based on risk, regardless of the provider.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.