CISM Information Security Program Practice Question
A multinational corporation is designing its information security program and must decide how to balance security with business agility. The company operates in highly regulated industries with varying legal requirements. Which of the following approaches BEST aligns with industry best practices for such an environment?
⚠ Common exam trap
It's easy for candidates to confuse 'strictest globally' (Option A) with 'best practice' due to a desire for simplicity, but CISM emphasizes that a risk-based approach is the only method that effectively balances compliance, security, and business agility in a multi-regulatory environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Develop a risk-based framework that allows for tailored controls based on local risk assessments.
A risk-based framework, such as ISO 27001 or NIST SP 800-53, allows the organization to establish a baseline of controls while tailoring them to address specific local legal requirements and risk profiles. This approach balances security and business agility by avoiding unnecessary overhead from overly strict global mandates while ensuring that critical regulatory obligations are met through localized risk assessments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement the strictest regulatory requirements globally to ensure compliance everywhere.
Why it's wrong here
Applying the strictest requirements everywhere imposes controls beyond what many jurisdictions require, adding cost and friction without compliance benefit. It is tempting because it guarantees no regulatory gap, but best practice maps controls to each region's actual obligations rather than over-applying one standard globally.
- ✗
Adopt a baseline of controls that meet the lowest common denominator of all regulations.
Why it's wrong here
A lowest-common-denominator baseline leaves the strictest jurisdictions non-compliant, since it satisfies only the weakest requirement. It is tempting because a single uniform control set appears to simplify governance and preserve agility, but varying legal obligations demand controls meeting the highest applicable bar.
- ✓
Develop a risk-based framework that allows for tailored controls based on local risk assessments.
Why this is correct
A risk-based framework lets the corporation apply controls proportionate to assessed local risk, accommodating differing legal requirements across regulated jurisdictions while preserving business agility. Uniform or purely compliance-driven controls cannot flex to each region's distinct regulatory and risk profile.
- ✗
Allow each business unit to define its own security controls based on local requirements.
Why it's wrong here
Devolving control to business units fragments the control baseline, so no consistent mapping exists across differing legal regimes; a central framework with local tailoring satisfies them. It is tempting because local autonomy genuinely suits low-regulation, single-jurisdiction units where speed outweighs uniformity.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.