CISM Information Security Risk Management Practice Question
A retail company's risk committee is reviewing the annual risk assessment. The CISO notes that the organization's stated risk appetite for customer data confidentiality is low, but a business unit wants to launch a loyalty program that shares purchase history with a third-party analytics provider. Which of the following should the CISO do FIRST?
⚠ Common exam trap
The trap here is equating a low risk appetite with automatic rejection instead of requiring an assessment to determine residual risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a risk assessment of the proposed data sharing and compare the residual risk to the defined risk appetite.
Risk decisions should begin with assessment. The CISO must evaluate the data-sharing risk and compare residual exposure to the organization's low confidentiality appetite before recommending acceptance, mitigation, or rejection. Approving on reputation, escalating without analysis, or rejecting categorically all skip the assessment step that makes the decision defensible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Approve the program because the third party has a strong security reputation.
Why it's wrong here
Reputation is not a substitute for assessing whether the initiative aligns with the organization's stated risk appetite. Approving without analysis bypasses the risk management process and could expose the company to regulatory and contractual consequences. The CISO's first responsibility is to evaluate the risk against established criteria, not to rely on the vendor's market standing.
- ✗
Reject the program because any third-party data sharing exceeds a low risk appetite.
Why it's wrong here
A low risk appetite does not automatically prohibit all third-party sharing; it requires that residual risk be kept low through appropriate controls and contractual terms. Rejecting outright without assessment is premature and may block legitimate business value. The CISO should evaluate whether controls can reduce risk to an acceptable level before recommending rejection.
- ✓
Perform a risk assessment of the proposed data sharing and compare the residual risk to the defined risk appetite.
Why this is correct
The first step is to assess the risk introduced by sharing purchase history and determine whether residual risk falls within the low appetite for customer data confidentiality. This provides an objective basis for a recommendation or escalation. Only after assessment can the organization decide to accept, mitigate, transfer, or reject the initiative.
- ✗
Escalate the decision to the board of directors immediately.
Why it's wrong here
Escalation is appropriate only after the risk has been assessed and a decision exceeds the CISO's authority or the defined appetite. Escalating first without analysis gives the board no basis for a decision and wastes governance time. The CISO should bring a risk-informed recommendation, not an unassessed request, to senior leadership.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.