mediumMultiple Choice
CISM Practice Question: A multinational corporation is designing an…
A multinational corporation is designing an information security strategy to support its global operations. Which approach best ensures that the strategy is actionable and measurable?
⚠ Common exam trap
Test-takers frequently confuse tactical tools (cost-benefit analysis) or generic frameworks (best practices) with the strategic governance requirement for measurable alignment, overlooking that only KPIs and KRIs provide the continuous, business-linked metrics needed to make a strategy actionable and measurable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define KPIs and KRIs aligned with business goals
KPIs (Key Performance Indicators) and KRIs (Key Risk Indicators) provide quantifiable metrics that directly tie security activities to business objectives, ensuring the strategy is both actionable (through measurable targets) and measurable (through defined thresholds). This alignment allows the multinational corporation to track progress, demonstrate value to stakeholders, and adjust controls based on risk appetite, which is essential for global operations with diverse regulatory and operational contexts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct a cost-benefit analysis of security controls
Why it's wrong here
Cost-benefit analysis compares control costs against expected loss reduction for individual investments; it yields no strategy-level objectives, metrics or governance. It is correct when justifying a specific control's funding, not when ensuring the whole strategy is actionable and measurable.
- ✗
Base the strategy on industry best practices
Why it's wrong here
Industry best practices describe what peers do generally; they carry no organisation-specific metrics, baselines or accountability, so progress cannot be measured. Best practices are the right basis when establishing a starting control set, not when the strategy must be actionable and measurable for a specific corporation.
- ✓
Define KPIs and KRIs aligned with business goals
Why this is correct
KPIs measure performance against business objectives and KRIs flag rising risk exposure, giving the global strategy quantifiable, actionable metrics. This directly satisfies the requirement that the strategy be both actionable and measurable across multinational operations.
- ✗
Adopt a leading-edge technology roadmap
Why it's wrong here
A technology roadmap lists planned deployments and upgrades, giving no metrics, owners or control targets against which progress can be measured. Roadmaps are correct when sequencing technology adoption, not when the requirement is an actionable, measurable security strategy tied to business objectives.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.