CISM Information Security Program Practice Question
A multinational corporation is designing an information security program to align with diverse business units and regulatory requirements across different regions. The CISO is prioritizing key components that ensure the program is both comprehensive and adaptable. Which TWO components are most critical for achieving this alignment?
⚠ Common exam trap
A common mix-up: candidates confuse 'comprehensive' with 'uniform,' leading them to choose Option D (single framework) or Option A (most stringent rule), when in reality, adaptability requires a governance structure that can manage multiple frameworks and exceptions, not a one-size-fits-all approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establishing a governance structure with defined roles, responsibilities, and oversight
A governance structure with defined roles, responsibilities, and oversight (Option B) is critical because it provides the authority, accountability, and decision-making framework needed to align security activities with diverse business units and regulatory requirements. Without clear governance, the program lacks the mechanisms to enforce policies, manage exceptions, and adapt to regional legal variations, such as GDPR in Europe or CCPA in California.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Focusing exclusively on the most stringent regulatory requirement to satisfy all others
Why it's wrong here
While stringent requirements may cover many areas, they may not satisfy all specific obligations, leading to non-compliance gaps.
- ✓
Establishing a governance structure with defined roles, responsibilities, and oversight
Why this is correct
A governance structure provides the foundation for consistent decision-making and accountability across the organization.
- ✓
Creating a control framework that maps common controls to multiple regulatory requirements
Why this is correct
Mapping common controls streamlines compliance and ensures efficiency by avoiding duplicate controls.
- ✗
Adopting a single security framework such as ISO 27001 for all regions
Why it's wrong here
A single framework may not address region-specific regulatory nuances, leading to gaps in compliance.
- ✗
Implementing separate security programs for each business unit to address unique needs
Why it's wrong here
Separate programs create redundancy, increase costs, and hinder enterprise-wide visibility and consistency.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.