CISM Information Security Governance Practice Question
A multinational organization must comply with GDPR, CCPA, and PCI DSS. The security manager is designing a compliance monitoring program. Which approach is MOST efficient?
⚠ Common exam trap
CISM often tests the misconception that the 'strictest regulation' subsumes all others — candidates pick option C, but regulations have non-overlapping obligations, so harmonization via control mapping is the efficient answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Map common controls to multiple regulations
Mapping common controls to multiple regulations lets the organization satisfy GDPR, CCPA, and PCI DSS through a unified control set, eliminating duplicated evidence collection, testing, and reporting. Many controls (access management, encryption, logging, incident response) overlap heavily across these frameworks, so a single mapped control can demonstrate compliance with several regulations at once. This is the standard 'control harmonization' approach recommended in GRC practice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create separate monitoring programs for each regulation
Why it's wrong here
Separate programs duplicate controls for overlapping requirements such as access management and encryption, multiplying monitoring effort across three regimes. It appeals because each regulation has distinct obligations, yet a unified control framework mapped to all three satisfies them without redundant tooling.
- ✗
Outsource compliance to a third-party
Why it's wrong here
Outsourcing transfers processing to a processor, yet GDPR Article 28 and PCI DSS 12.8/12.9 still hold the organisation accountable for monitoring and evidence, so accountability cannot be delegated. It tempts because managed compliance services genuinely suit organisations lacking in-house expertise or staff, where a provider supplies specialist capability the business cannot sustain internally.
- ✗
Focus only on the strictest regulation
Why it's wrong here
Focusing only on the strictest regulation leaves the other two unmonitored, so CCPA and PCI DSS controls go unchecked. It appeals because one baseline can reduce duplicated effort, but GDPR's strictness does not encompass PCI DSS's cardholder data requirements or CCPA's consumer rights.
- ✓
Map common controls to multiple regulations
Why this is correct
Mapping common controls to multiple regulations lets one control satisfy overlapping GDPR, CCPA and PCI DSS requirements, eliminating duplicate evidence collection and testing. This satisfies the efficiency constraint by reducing assessment effort while maintaining demonstrable compliance across all three frameworks.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.