CISM Information Security Program Practice Question
A multinational organization needs to comply with GDPR and CCPA. What is the best approach for the information security program?
⚠ Common exam trap
ISACA often tests the misconception that 'most restrictive' is always best, but the trap here is that regulatory compliance requires a tailored, risk-based approach rather than a blanket adoption of the strictest rule, which can lead to inefficiency and non-compliance with specific regional obligations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a unified privacy framework covering all regulations
A unified privacy framework (e.g., ISO/IEC 27701 or NIST Privacy Framework) allows the organization to map overlapping requirements from GDPR and CCPA into a single set of controls, reducing duplication and ensuring consistent data protection across jurisdictions. This approach leverages common principles like data minimization, consent management, and breach notification, which are foundational to both regulations, while accommodating specific differences such as GDPR's 72-hour breach notification versus CCPA's broader definition of personal information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a unified privacy framework covering all regulations
Why this is correct
A unified framework ensures compliance while maintaining efficiency.
- ✗
Adopt the most restrictive requirements from any regulation
Why it's wrong here
This could lead to unnecessary costs and operational burden.
- ✗
Outsource compliance to a third-party provider
Why it's wrong here
Outsourcing does not absolve the organization of responsibility and may introduce new risks.
- ✗
Create separate security programs for each region
Why it's wrong here
Separate programs increase complexity and inconsistency.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.