easyMultiple Choice
CISM Practice Question: A hospital chain has separate security teams for…
A hospital chain has separate security teams for each facility. There is no central coordination, leading to duplicate efforts and inconsistent patient data protection. The system's CISO wants to improve governance with minimal disruption. What should he do?
⚠ Common exam trap
It's easy for candidates to assume centralization (Option A) is the only way to achieve consistency, but the CISM exam emphasizes governance structures that balance coordination with minimal disruption, making a committee-based approach the correct choice over a full reorganization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a governance committee with representatives from each facility
A governance committee with representatives from each facility establishes a federated governance model that aligns security practices across the hospital chain without restructuring teams. This approach enables consistent policy development, shared oversight, and coordination of patient data protection efforts while minimizing operational disruption, as each facility retains its existing team structure. It directly addresses the lack of central coordination and duplicate efforts by creating a collaborative decision-making body, which is a core principle of information security governance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Merge all teams into one central unit
Why it's wrong here
Merging every facility team into one central unit removes local presence and creates major organisational upheaval, contradicting the minimal-disruption requirement. It is tempting because consolidation eliminates duplication, but the stem needs coordinated governance across distributed sites, not the structural demolition of existing teams.
- ✗
Implement a top-down mandate for all policies
Why it's wrong here
A top-down mandate imposes policies without facility input, which disrupts local operations and breeds resistance rather than coordinating effort. It is tempting because central authority appears decisive, yet governance improvement here needs a federated structure aligning facility teams under shared standards while preserving their autonomy.
- ✓
Create a governance committee with representatives from each facility
Why this is correct
A governance committee with facility representatives establishes federated decision-making, letting each security team retain local control while aligning policies and eliminating duplicated effort. This directly satisfies the CISO's constraints of minimal disruption and no central coordination, since authority is shared rather than imposed, and inconsistent patient data protection is resolved through agreed, cross-facility standards.
- ✗
Outsource security to a third party
Why it's wrong here
Outsourcing transfers security responsibility to a third party, adding contractual complexity and removing internal control without addressing the coordination gap between facility teams. It is tempting as a quick route to consistency, but governance improvement requires internal alignment of existing teams, not external delegation.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.