easyMultiple Choice
CISM Practice Question: A retail company's security governance includes a…
A retail company's security governance includes a policy that all software must be approved by a security committee. This delays critical business applications. The CIO complains. How should the CISO adjust governance?
⚠ Common exam trap
It's easy for candidates to choose automation (Option D) thinking it solves delays, but without risk-based triage, automation just accelerates a flawed process that still treats all software equally, failing to address the CIO's core concern about critical business applications being delayed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a risk-based approval process with expedited paths
A risk-based approval process with expedited paths allows the security committee to focus on high-risk software while fast-tracking low-risk or critical business applications. This balances security governance with business agility, addressing the CIO's complaint without compromising security. It aligns with CISM's emphasis on aligning security with business objectives through risk management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase committee meeting frequency
Why it's wrong here
Increasing meeting frequency still routes every approval through the same committee bottleneck, so the delay persists rather than being removed. It is tempting because cadence tuning genuinely helps when throughput is limited by infrequent decision points, such as monthly review boards with otherwise sound delegated authority. Here the constraint is the approval gate itself, not its scheduling.
- ✓
Implement a risk-based approval process with expedited paths
Why this is correct
A risk-based approval process with expedited paths replaces blanket committee review with tiered assessment, letting low-risk business applications proceed quickly while high-risk ones still receive scrutiny. This preserves governance oversight yet removes the bottleneck causing the CIO's complaint about delayed critical applications.
- ✗
Remove the approval requirement
Why it's wrong here
Dropping approval entirely removes the risk gate, leaving unvetted software free to enter production; the governance gap is the committee's throughput, not its existence. Removing approval fits environments with no regulatory or security obligation over software provenance.
- ✗
Automate software approval
Why it's wrong here
Automating approval still routes every application through the same committee gate, so the delay persists; the bottleneck is the approval authority, not its tooling. It tempts because workflow automation genuinely suits high-volume, low-risk requests under a delegated threshold. Here the stem requires governance that scales with business risk, which automation alone cannot deliver.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.