easyMultiple ChoiceObjective-mapped
CISM Practice Question: A company's information security manager is…
A company's information security manager is tasked with ensuring that security initiatives align with business goals. Which of the following best demonstrates this alignment?
⚠ Common exam trap
The trap here is that candidates often mistake compliance-driven or technically optimal approaches (like risk-based prioritization) as sufficient for alignment, but the CISM exam emphasizes that true alignment requires bidirectional linkage between security metrics and business performance indicators, not just technical or regulatory adherence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establishing security metrics that are linked to key business performance indicators.
Aligning security metrics with key business performance indicators (KPIs) ensures that security initiatives directly support and demonstrate value to business objectives, such as revenue protection, customer trust, or operational efficiency. This is a core principle of information security governance, where security is treated as a business enabler rather than a technical silo. For example, tracking 'mean time to detect (MTTD)' and 'mean time to respond (MTTR)' as security metrics linked to business continuity KPIs shows how security investments reduce business risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Prioritizing security projects based solely on technical risk assessment.
Why it's wrong here
Technical risk is important but must be balanced with business impact and objectives.
- ✗
Implementing all security controls required by regulatory standards.
Why it's wrong here
Compliance is necessary but does not ensure alignment with specific business goals.
- ✗
Creating a security budget that allocates funds equally across departments.
Why it's wrong here
Equal allocation does not reflect varying levels of business risk or strategic importance.
- ✓
Establishing security metrics that are linked to key business performance indicators.
Why this is correct
This directly ties security outcomes to business success, demonstrating alignment.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.