mediumMultiple ChoiceObjective-mapped
CISM Practice Question: A multinational corporation is establishing an…
A multinational corporation is establishing an information security governance framework. The board has approved a top-down approach where security policies are created at the corporate level and adapted locally. Which of the following is a key benefit of this approach?
⚠ Common exam trap
It's easy for candidates to confuse 'adapting locally' with 'creating locally' (Option A), failing to recognize that the key benefit of a top-down model is ensuring a consistent baseline while accommodating local legal adjustments, not delegating full policy creation to subsidiaries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It ensures a consistent baseline of security controls while allowing for local regulatory adjustments.
A top-down governance approach ensures that a consistent baseline of security controls is mandated at the corporate level, which is critical for managing risk across a multinational enterprise. By allowing local adaptation, the framework can incorporate region-specific legal requirements (e.g., GDPR in Europe, CCPA in California) without deviating from the core security posture. This balance between uniformity and flexibility is the primary benefit, as it prevents fragmented security while respecting jurisdictional mandates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
It allows each subsidiary to develop security policies that best fit their local legal environment.
Why it's wrong here
That would be a bottom-up approach, not top-down.
- ✗
It reduces the time required to implement security policies across the entire organization.
Why it's wrong here
Top-down may be faster to mandate, but local adaptation can slow implementation.
- ✗
It minimizes the need for local security teams to understand the corporate strategy.
Why it's wrong here
Local teams still need to align with corporate strategy to adapt policies.
- ✓
It ensures a consistent baseline of security controls while allowing for local regulatory adjustments.
Why this is correct
This balances uniformity with flexibility.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.