easyMultiple ChoiceObjective-mapped
CISM Practice Question: A retail company's security governance includes a…
A retail company's security governance includes a policy that all software must be approved by a security committee. This delays critical business applications. The CIO complains. How should the CISO adjust governance?
⚠ Common exam trap
It's easy for candidates to choose automation (Option D) thinking it solves delays, but without risk-based triage, automation just accelerates a flawed process that still treats all software equally, failing to address the CIO's core concern about critical business applications being delayed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a risk-based approval process with expedited paths
A risk-based approval process with expedited paths allows the security committee to focus on high-risk software while fast-tracking low-risk or critical business applications. This balances security governance with business agility, addressing the CIO's complaint without compromising security. It aligns with CISM's emphasis on aligning security with business objectives through risk management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase committee meeting frequency
Why it's wrong here
Does not address the delay caused by process.
- ✓
Implement a risk-based approval process with expedited paths
Why this is correct
Speeds up low-risk approvals while maintaining security.
- ✗
Remove the approval requirement
Why it's wrong here
Eliminates security review.
- ✗
Automate software approval
Why it's wrong here
Automation may not account for risk differentiation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.