CISM Information Security Governance Practice Question

A CISO is developing a security strategy. Which THREE elements should be included in a multi-year security roadmap?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Milestones for achieving target capability maturity levels

A roadmap should include milestones, resource allocation, and alignment with business objectives to guide implementation over time.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Milestones for achieving target capability maturity levels
Why this is correct
Milestones help track progress and ensure the roadmap is actionable.
✗
Current vulnerability scan results
Why it's wrong here
This is a point-in-time operational snapshot, not a strategic roadmap element.
✗
Detailed network architecture diagrams
Why it's wrong here
Technical detail not appropriate for a strategic roadmap.
✓
Resource allocation for each initiative
Why this is correct
Resources (budget, staff) are critical for executing the roadmap.
✓
Alignment with business strategic goals
Why this is correct
Ensuring security initiatives support business objectives is fundamental.

Go deeper