CISM Information Security Program Practice Question
A company is designing its information security program and wants to ensure that it meets regulatory requirements across multiple jurisdictions. Which of the following approaches is most appropriate?
⚠ Common exam trap
A common mistake in CISM is assuming that adopting a single, comprehensive standard like ISO 27001 is sufficient for multi-jurisdictional compliance, when in reality it must be supplemented with a mapping framework to address specific legal requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a regulatory compliance framework that maps controls to applicable laws and standards.
A regulatory compliance framework that maps controls to applicable laws and standards provides a structured, auditable method to address multiple, sometimes conflicting, jurisdictional requirements. This approach ensures that each control is explicitly linked to a specific legal or regulatory obligation, facilitating compliance verification and reducing the risk of oversight. It is the most comprehensive and adaptable method for a multi-jurisdictional environment, as it allows the organization to manage overlapping and unique requirements without relying on a single standard or external review alone.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Adopt ISO 27001 as the sole framework for the program.
Why it's wrong here
ISO 27001 is a good baseline but may not cover all specific legal requirements.
- ✓
Implement a regulatory compliance framework that maps controls to applicable laws and standards.
Why this is correct
Maps controls to regulations, ensuring comprehensive and consistent compliance.
- ✗
Comply with the strictest regulation and ignore others.
Why it's wrong here
May result in non-compliance in other jurisdictions.
- ✗
Engage external legal counsel to review policies quarterly.
Why it's wrong here
Legal counsel provides advice but does not ensure ongoing program execution.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.