easyMultiple ChoiceObjective-mapped
CISM Practice Question: A CISO is developing an information security…
A CISO is developing an information security governance framework for a financial institution. Which of the following is the PRIMARY purpose of such a framework?
⚠ Common exam trap
It's easy for candidates to confuse the tactical goal of risk reduction (Option A) with the strategic purpose of governance, but CISM emphasizes that governance is about aligning security with business objectives, not just minimizing risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Align security with business objectives
The primary purpose of an information security governance framework is to align security initiatives with business objectives, ensuring that security investments and activities directly support the organization's strategic goals. For a financial institution, this alignment ensures that security governance drives value, manages risk in context of business priorities, and enables informed decision-making by leadership.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Minimize risks to an acceptable level
Why it's wrong here
Risk reduction is a goal of governance, but the primary purpose is alignment with business objectives.
- ✓
Align security with business objectives
Why this is correct
Governance ensures that security investments and activities support the business strategy and deliver value.
- ✗
Ensure compliance with regulatory requirements
Why it's wrong here
Compliance is an important aspect but not the primary purpose; it is a subset of governance.
- ✗
Deploy the latest security technologies
Why it's wrong here
Technology deployment is an operational activity, not the overarching purpose of governance.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.