hardMultiple ChoiceObjective-mapped
CISM Practice Question: A company's information security manager notices…
A company's information security manager notices that several business units have implemented shadow IT systems that bypass the central security governance. Which of the following governance strategies would most effectively address this issue in the long term?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish a formal process for business units to request exceptions to the standard IT policy, with risk acceptance.
Establishing a formal exception process with risk acceptance allows business units to innovate while maintaining security governance. This approach addresses shadow IT by integrating it into formal oversight rather than punishing or ignoring it. Option A is incorrect because penalizing non-compliant units may drive shadow IT further underground, reducing visibility. Option B is incorrect because deploying a CASB is a technical control that helps discover and manage shadow IT, but it does not address the root governance issue of why business units bypass central IT. Option C is incorrect because a strict prohibition policy is difficult to enforce and may hinder business agility, leading to further shadow IT.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct periodic audits to discover shadow IT and penalize non-compliant units.
Why it's wrong here
Punitive measures do not address the underlying need for flexibility.
- ✗
Deploy a cloud access security broker (CASB) to discover and integrate shadow IT into the infrastructure.
Why it's wrong here
Technical solutions are helpful but lack the governance framework for long-term management.
- ✗
Enforce a strict policy that prohibits any IT system without prior security approval.
Why it's wrong here
This may not be practical and could lead to non-compliance.
- ✓
Establish a formal process for business units to request exceptions to the standard IT policy, with risk acceptance.
Why this is correct
This balances security with business agility and maintains governance visibility.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.