easyMultiple ChoiceObjective-mapped
CISM Practice Question: A hospital chain has separate security teams for…
A hospital chain has separate security teams for each facility. There is no central coordination, leading to duplicate efforts and inconsistent patient data protection. The system's CISO wants to improve governance with minimal disruption. What should he do?
⚠ Common exam trap
It's easy for candidates to assume centralization (Option A) is the only way to achieve consistency, but the CISM exam emphasizes governance structures that balance coordination with minimal disruption, making a committee-based approach the correct choice over a full reorganization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a governance committee with representatives from each facility
A governance committee with representatives from each facility establishes a federated governance model that aligns security practices across the hospital chain without restructuring teams. This approach enables consistent policy development, shared oversight, and coordination of patient data protection efforts while minimizing operational disruption, as each facility retains its existing team structure. It directly addresses the lack of central coordination and duplicate efforts by creating a collaborative decision-making body, which is a core principle of information security governance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Merge all teams into one central unit
Why it's wrong here
Causes disruption and may face resistance.
- ✗
Implement a top-down mandate for all policies
Why it's wrong here
May not account for local operational differences.
- ✓
Create a governance committee with representatives from each facility
Why this is correct
Promotes coordination and minimal disruption.
- ✗
Outsource security to a third party
Why it's wrong here
Does not address internal governance coordination.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.