CISM Information Security Risk Management Practice Question
A global manufacturing firm is expanding into a new region where data residency laws differ significantly from its home country. The CISO must present a risk treatment plan to the board. Which of the following is the MOST appropriate FIRST step in aligning risk treatment with the organization's risk appetite?
⚠ Common exam trap
The trap here is assuming that a technical control like encryption or a BIA is the first step, when the board's risk appetite must be established to guide treatment decisions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the board's risk appetite statement and tolerance levels for the new region.
Aligning risk treatment with risk appetite begins with understanding the board's appetite and tolerance. The risk appetite statement defines the amount and type of risk the organization is willing to accept, which then guides the selection of controls. Only after this alignment can a gap analysis, BIA, or control implementation be effectively prioritized. Thus, reviewing the board's risk appetite is the essential first step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement encryption for all data stored in the new region.
Why it's wrong here
Implementing encryption is a tactical control that may or may not align with the board's risk appetite. Without first understanding appetite and tolerance, the organization risks deploying controls that are either insufficient or excessive. Encryption also does not address all data residency risks, such as access by foreign governments. This action is premature before establishing risk criteria.
- ✓
Review the board's risk appetite statement and tolerance levels for the new region.
Why this is correct
The board's risk appetite and tolerance levels provide the criteria for evaluating and treating risks. Aligning treatment with appetite requires first understanding what the board deems acceptable. This step ensures that subsequent risk assessments and control decisions are consistent with organizational objectives and regulatory constraints. It is the foundational step before any analysis or control implementation in the new region.
- ✗
Perform a gap analysis of current controls against the new region's regulatory requirements.
Why it's wrong here
A gap analysis identifies missing controls relative to regulations, but it does not ensure alignment with the organization's risk appetite. Risk appetite defines how much risk the board is willing to accept, which must be established before evaluating control gaps. Without that context, the gap analysis may lead to over- or under-investment in controls for the new region.
- ✗
Conduct a business impact analysis (BIA) for all regional operations.
Why it's wrong here
A BIA identifies critical business functions and recovery priorities, but it does not directly align risk treatment with the board's risk appetite. The first step should be to understand the board's risk appetite and then assess risks against it. A BIA is valuable later for continuity planning, yet it fails to establish the risk appetite linkage required for treatment decisions in this scenario.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.