CISM Information Security Governance Practice Question
A global retailer is expanding into new markets and must comply with varying data protection laws. The CISO is revising the information security strategy to ensure it remains aligned with the changing business environment. Which approach BEST ensures ongoing alignment between the security strategy and business objectives?
⚠ Common exam trap
The trap here is equating framework adoption or penetration testing with strategic alignment, when true alignment requires embedding security into the business planning cycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrate security strategy reviews into the enterprise strategic planning cycle and adjust based on business changes.
Integrating security strategy reviews into the enterprise strategic planning cycle ensures that security is continuously aligned with business objectives, especially as the retailer enters new markets with different regulations. This approach makes alignment a proactive, recurring process rather than a one-off or reactive activity. It enables the CISO to adjust security initiatives in response to business changes, which is critical for effective governance and risk management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delegate strategy updates to the security operations team based on emerging threats.
Why it's wrong here
Delegating strategy updates to the security operations team is inappropriate because strategy formulation requires senior leadership and business input. The operations team focuses on day-to-day threat response and lacks the perspective to align security with business goals. This approach would result in a reactive, threat-centric strategy that may not support market expansion or comply with diverse regulations, and it undermines governance accountability.
- ✗
Conduct an annual penetration test and use the results to update the security strategy.
Why it's wrong here
Penetration testing assesses technical vulnerabilities but does not address strategic alignment with business objectives. While useful for identifying gaps, it is a tactical control that does not inform whether security investments support business expansion or regulatory compliance. Relying solely on annual tests would leave the strategy reactive and disconnected from the broader business planning process, failing to ensure ongoing alignment.
- ✓
Integrate security strategy reviews into the enterprise strategic planning cycle and adjust based on business changes.
Why this is correct
Embedding security strategy reviews into the enterprise strategic planning cycle ensures that security remains aligned with business objectives as markets and regulations evolve. This approach makes alignment a recurring, proactive activity rather than a one-time effort. It allows the CISO to anticipate changes and adjust security initiatives in tandem with business strategy, which is essential for effective governance in a dynamic environment.
- ✗
Adopt a widely recognized security framework and mandate compliance with its controls.
Why it's wrong here
Adopting a framework is valuable for establishing a baseline, but it does not ensure alignment with specific business objectives or changing market conditions. Frameworks are generic and may not address the unique regulatory and business context of each new market. Without integration into strategic planning, framework compliance can become a checkbox exercise that fails to adapt to evolving business needs, thus not ensuring ongoing alignment.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.