CISM Information Security Programme Practice Question
A security manager is drafting the information security strategy for a multinational retailer. Executive leadership has asked how the strategy should be structured to remain aligned with business objectives over the next three years. Which approach BEST addresses this request?
⚠ Common exam trap
The trap here is assuming a security strategy is built from technical findings or peer benchmarks rather than from the business strategy it must support.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Derive the security strategy from the organization's business strategy and refresh it through an annual governance review tied to business planning.
Strategy alignment means the security programme exists to enable business objectives, so the strategy must be derived from the business strategy and revisited on the same planning cadence. Governance review tied to business planning keeps risk appetite, funding, and priorities synchronized. Technical artefacts such as penetration tests or competitor frameworks inform tactics but cannot define strategic direction for the organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Derive the security strategy from the organization's business strategy and refresh it through an annual governance review tied to business planning.
Why this is correct
A security strategy must cascade from and support the business strategy, otherwise it becomes a technology wish list disconnected from value creation. Tying the refresh to the annual business planning cycle keeps objectives, risk appetite, and funding aligned as the retailer expands into new markets, and gives governance bodies a predictable point to reassess priorities.
- ✗
Base the strategy on the most recent penetration test findings and reissue it whenever a critical vulnerability is discovered.
Why it's wrong here
Penetration test findings are tactical inputs about specific weaknesses, not a source of business direction. Reissuing the whole strategy per vulnerability creates churn, ignores business strategy and risk appetite, and leaves the retailer reacting to individual technical events rather than steering security investment toward its long-term objectives.
- ✗
Let the IT steering committee define the strategy and forward it to the CISO for technical review before board approval.
Why it's wrong here
Delegating strategy definition to an IT steering committee makes security an infrastructure afterthought and inverts accountability. The security function should own and drive the strategy with business input, not merely review a document produced elsewhere, because alignment requires security leadership to translate business objectives into protection requirements.
- ✗
Adopt the security framework used by the largest competitor and implement its controls in the same sequence.
Why it's wrong here
Copying a competitor's framework assumes identical risk appetite, regulatory exposure, and business model, none of which are guaranteed. Frameworks are useful reference structures, but selecting and sequencing controls must reflect the retailer's own business objectives and risk assessment, so competitor mimicry cannot deliver true alignment.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.