mediumMultiple ChoiceObjective-mapped
CISM Practice Question: A multinational corporation is designing an…
A multinational corporation is designing an information security strategy to support its global operations. Which approach best ensures that the strategy is actionable and measurable?
⚠ Common exam trap
Test-takers frequently confuse tactical tools (cost-benefit analysis) or generic frameworks (best practices) with the strategic governance requirement for measurable alignment, overlooking that only KPIs and KRIs provide the continuous, business-linked metrics needed to make a strategy actionable and measurable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define KPIs and KRIs aligned with business goals
KPIs (Key Performance Indicators) and KRIs (Key Risk Indicators) provide quantifiable metrics that directly tie security activities to business objectives, ensuring the strategy is both actionable (through measurable targets) and measurable (through defined thresholds). This alignment allows the multinational corporation to track progress, demonstrate value to stakeholders, and adjust controls based on risk appetite, which is essential for global operations with diverse regulatory and operational contexts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct a cost-benefit analysis of security controls
Why it's wrong here
Cost-benefit analysis informs decisions but does not ensure the strategy is actionable or measurable.
- ✗
Base the strategy on industry best practices
Why it's wrong here
Best practices provide guidance but may not be tailored to the organization's unique needs or measurable.
- ✓
Define KPIs and KRIs aligned with business goals
Why this is correct
KPIs and KRIs provide quantifiable metrics to monitor performance and risk, making the strategy actionable.
- ✗
Adopt a leading-edge technology roadmap
Why it's wrong here
Technology adoption without measurable objectives does not guarantee alignment with business goals.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.