hardMultiple ChoiceObjective-mapped
CISM Practice Question: A financial institution is integrating a newly…
A financial institution is integrating a newly acquired fintech startup. The startup has a very different security culture. What governance approach best ensures integration without stifling innovation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a transitional risk-based approach, phasing in critical controls while allowing flexibility
A transitional risk-based approach balances control with flexibility, allowing the fintech startup to maintain some of its innovative security practices while gradually aligning with the institution's critical controls. Option A is incorrect because indefinitely allowing the startup to maintain its own policies creates ongoing security gaps and governance inconsistency. Option B is incorrect because forcing immediate adoption of all policies would likely stifle innovation and cause resistance, potentially harming the startup's culture. Option D is incorrect because creating a separate security team can lead to silos and undermines unified governance. The transitional approach minimizes disruption while ensuring essential compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Allow the startup to maintain its own security policies indefinitely
Why it's wrong here
This preserves inconsistency and governance gaps.
- ✗
Force the startup to adopt all of the institution's policies immediately
Why it's wrong here
This may disrupt the startup's agility and cause cultural clash.
- ✓
Use a transitional risk-based approach, phasing in critical controls while allowing flexibility
Why this is correct
This method ensures security while respecting the startup's culture and innovation.
- ✗
Create a separate security team for the startup
Why it's wrong here
This does not foster integration and may increase costs.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.