CISM Information Security Program Practice Question
A multinational corporation is designing its information security program and must decide how to balance security with business agility. The company operates in highly regulated industries with varying legal requirements. Which of the following approaches BEST aligns with industry best practices for such an environment?
⚠ Common exam trap
It's easy for candidates to confuse 'strictest globally' (Option A) with 'best practice' due to a desire for simplicity, but CISM emphasizes that a risk-based approach is the only method that effectively balances compliance, security, and business agility in a multi-regulatory environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Develop a risk-based framework that allows for tailored controls based on local risk assessments.
A risk-based framework, such as ISO 27001 or NIST SP 800-53, allows the organization to establish a baseline of controls while tailoring them to address specific local legal requirements and risk profiles. This approach balances security and business agility by avoiding unnecessary overhead from overly strict global mandates while ensuring that critical regulatory obligations are met through localized risk assessments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement the strictest regulatory requirements globally to ensure compliance everywhere.
Why it's wrong here
This can be excessively restrictive and reduce business agility in regions with lighter regulations.
- ✗
Adopt a baseline of controls that meet the lowest common denominator of all regulations.
Why it's wrong here
This may leave high-risk areas under-protected and does not address stricter requirements.
- ✓
Develop a risk-based framework that allows for tailored controls based on local risk assessments.
Why this is correct
A risk-based approach provides flexibility while ensuring that controls are appropriate for the risks.
- ✗
Allow each business unit to define its own security controls based on local requirements.
Why it's wrong here
Without central coordination, this can lead to fragmentation and ineffective risk management.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.