easyMultiple Choice
CISM Practice Question: A CISO is developing an information security…
A CISO is developing an information security governance framework for a financial institution. Which of the following is the PRIMARY purpose of such a framework?
⚠ Common exam trap
It's easy for candidates to confuse the tactical goal of risk reduction (Option A) with the strategic purpose of governance, but CISM emphasizes that governance is about aligning security with business objectives, not just minimizing risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Align security with business objectives
The primary purpose of an information security governance framework is to align security initiatives with business objectives, ensuring that security investments and activities directly support the organization's strategic goals. For a financial institution, this alignment ensures that security governance drives value, manages risk in context of business priorities, and enables informed decision-making by leadership.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Minimize risks to an acceptable level
Why it's wrong here
Risk minimisation describes risk management activity, which governance directs rather than performs. The framework's primary purpose is strategic alignment, oversight and accountability across the organisation. Minimising risk to acceptable levels would be correct if the question asked about the objective of a risk treatment process.
- ✓
Align security with business objectives
Why this is correct
Governance exists to direct security investment and decisions toward organisational goals, not to serve technology for its own sake. Aligning security with business objectives ensures controls enable strategy and satisfy regulatory obligations, which is the framework's primary purpose for a financial institution.
- ✗
Ensure compliance with regulatory requirements
Why it's wrong here
Compliance is an outcome governance supports, not its primary purpose; a framework must first align security with business objectives and assign accountability. Financial institutions do face heavy regulation, so compliance tempts. Compliance would be correct if the stem asked what a regulatory mapping exercise specifically achieves.
- ✗
Deploy the latest security technologies
Why it's wrong here
Deploying security technologies is an operational control activity, not governance. A framework instead sets direction, assigns accountability and aligns security with business objectives. Technology deployment would be the right answer if the question asked how to implement specific controls after governance decisions are made.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.