CISM Information Security Governance Practice Question
A security awareness programme is being evaluated. Which metric BEST indicates a positive security culture?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Number of security incidents reported
The best metric for indicating a positive security culture is the number of security incidents reported. A high number of reported incidents demonstrates employee engagement, vigilance, and trust in the reporting process. This proactive behavior is a stronger indicator of a positive culture than metrics like phishing click rates, which primarily measure specific awareness effectiveness.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Number of policy violations
Why it's wrong here
Number of policy violations - A high number of violations indicates non-compliance, not a positive culture. A low number could be due to lack of reporting, so it is not a reliable indicator.
- ✗
Percentage of employees who completed training
Why it's wrong here
Percentage of employees who completed training - Training completion is important but does not directly reflect a positive culture, as employees may complete training without changing behavior.
- ✓
Number of security incidents reported
Why this is correct
Number of security incidents reported - Correct. A high number of reported incidents demonstrates employee engagement and a willingness to report, which is a key indicator of a positive security culture.
- ✗
Phishing simulation click rate
Why it's wrong here
Phishing simulation click rate - Low click rates are good for awareness, but they measure a specific behavior under testing conditions and do not capture the broader cultural aspect of proactive reporting.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.