CISM Information Security Governance Practice Question
A healthcare organization is developing its information security strategy. The CISO is considering how to best align the strategy with the organization's overall business strategy. Which of the following approaches would be MOST effective?
⚠ Common exam trap
The trap here is assuming that adopting a framework or focusing on compliance alone achieves alignment, when true alignment requires active integration with business strategy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrate security objectives into the business strategy planning process and participate in business strategy discussions.
The most effective approach to align security strategy with business strategy is to integrate security objectives into the business strategy planning process and participate in business strategy discussions. This ensures that security is a core consideration in business decisions, enabling the organization to achieve its goals while managing risk. Other approaches, such as independent development or exclusive focus on compliance, can lead to misalignment and missed opportunities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Focus the security strategy primarily on compliance with healthcare regulations such as HIPAA.
Why it's wrong here
While compliance is important, focusing solely on it may not fully align with business strategy. The business may have objectives beyond regulatory compliance, such as expanding services or improving patient care. The security strategy should support all business goals while ensuring compliance, not be limited to it.
- ✗
Ensure the security strategy is developed independently by the security team to avoid business influence.
Why it's wrong here
Developing the security strategy independently would likely result in misalignment with business objectives. The security strategy must support and enable the business, which requires input from business leaders. Isolation can lead to security initiatives that hinder business processes or fail to address critical business risks.
- ✗
Adopt a widely recognized security framework and tailor it to the organization's needs.
Why it's wrong here
Adopting a framework is a good practice, but it is not sufficient for alignment with business strategy. The framework provides structure, but the strategy must be driven by business objectives. Tailoring a framework is part of implementation, but the primary approach should be integrating security into business planning.
- ✓
Integrate security objectives into the business strategy planning process and participate in business strategy discussions.
Why this is correct
Integrating security objectives into the business strategy planning process ensures that security is considered from the outset. By participating in business strategy discussions, the CISO can align security initiatives with business goals, identify risks, and ensure that security enables rather than impedes business objectives. This collaborative approach is most effective for alignment.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.