CISM Information Security Program Practice Question
A security program manager is reviewing the results of a recent internal audit that identified several security gaps. The manager must prioritize remediation efforts. Which factor should be given the MOST weight?
⚠ Common exam trap
The trap here is that candidates often fixate on likelihood or cost as the primary factor, confusing operational efficiency with risk-based prioritization, but CISM stresses that business impact is the cornerstone of security program governance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Business impact of the vulnerability
In the context of information security program management, the primary driver for prioritizing remediation efforts is the business impact of the vulnerability. While likelihood, compensating controls, and cost are relevant factors, the CISM framework emphasizes that risk is ultimately a function of impact. A vulnerability with high business impact—such as one affecting a critical financial transaction system or protected health information (PHI)—demands immediate attention regardless of its exploitation likelihood, because the potential damage to revenue, compliance, and reputation is unacceptable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Likelihood of exploitation
Why it's wrong here
Likelihood is important but impact is often the deciding factor.
- ✓
Business impact of the vulnerability
Why this is correct
Impact determines potential harm to the organization and guides prioritization.
- ✗
Availability of compensating controls
Why it's wrong here
Compensating controls may reduce risk but do not negate the need to address the gap.
- ✗
Cost of remediation
Why it's wrong here
Cost is a resource consideration, not the primary priority factor.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.