CISM Information Security Risk Management Practice Question
A financial institution is implementing a risk management program and needs to select a methodology that balances quantitative and qualitative factors, complies with regulatory requirements, and provides a consistent framework for risk assessment across business units. Which methodology would best meet these requirements?
⚠ Common exam trap
A common mix-up: candidates confuse a risk assessment methodology (like FAIR or NIST SP 800-30) with a comprehensive risk management program methodology (like ISO 27005), which must include regulatory compliance and cross-unit consistency.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ISO 27005
ISO 27005 is the correct methodology because it provides a risk management framework that explicitly balances quantitative and qualitative factors, aligns with regulatory requirements like GDPR and SOX, and offers a consistent, scalable approach for risk assessment across diverse business units. It integrates seamlessly with ISO 27001, ensuring compliance and standardization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FAIR
Why it's wrong here
FAIR focuses on quantitative analysis of financial impact but is not a complete risk management standard and may not meet all regulatory requirements.
- ✗
OCTAVE
Why it's wrong here
OCTAVE is a qualitative methodology that does not inherently balance quantitative factors and is not a regulatory standard.
- ✓
ISO 27005
Why this is correct
ISO 27005 provides a comprehensive risk management framework that supports both qualitative and quantitative approaches and is widely accepted for regulatory compliance.
- ✗
NIST SP 800-30
Why it's wrong here
NIST SP 800-30 is primarily qualitative and tailored for US federal agencies, not ideal for balancing quantitative factors across business units.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.