mediumMultiple ChoiceObjective-mapped
CISM Practice Question: A large enterprise is implementing a new…
A large enterprise is implementing a new governance framework. The board has approved a risk appetite statement. What is the MOST important next step for the information security manager?
⚠ Common exam trap
It's easy for candidates to confuse the order of governance steps, mistakenly thinking that implementing controls (Option A) is the immediate next action, when in fact the risk acceptance criteria must be defined first to ensure controls are properly scoped and aligned with the board's risk appetite.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define risk acceptance criteria and thresholds
Once the board has approved a risk appetite statement, the information security manager must translate that high-level appetite into actionable risk acceptance criteria and thresholds. This step is critical because it defines the specific boundaries (e.g., maximum acceptable monetary loss per incident, maximum tolerable downtime) that guide all subsequent risk treatment decisions. Without these criteria, technical controls (Option A) and training (Option D) cannot be properly scoped, and audit plans (Option B) would lack measurable benchmarks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement technical controls to reduce risks
Why it's wrong here
Controls come after defining risk acceptance criteria.
- ✗
Develop an audit plan to monitor risk levels
Why it's wrong here
Audit plan follows criteria and implementation.
- ✓
Define risk acceptance criteria and thresholds
Why this is correct
Risk appetite needs operationalization through criteria.
- ✗
Conduct security awareness training for employees
Why it's wrong here
Awareness is important but not the immediate next step.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.