easyMultiple ChoiceObjective-mapped
CISM Practice Question: A small business cannot afford a dedicated…
A small business cannot afford a dedicated security team. Which governance model is most appropriate?
⚠ Common exam trap
A common mix-up: candidates choose Option D, mistakenly believing that delegating security to the IT manager is sufficient for governance, but CISM emphasizes that governance requires dedicated security expertise and strategic oversight, not just operational IT management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Hire a virtual CISO and outsource security operations
For a small business without the budget for a dedicated security team, the most appropriate governance model is to hire a virtual CISO (vCISO) and outsource security operations. This provides access to expert strategic guidance and managed security services (e.g., SIEM monitoring, incident response) at a fraction of the cost of a full-time internal team, aligning with the principle of risk-based resource allocation in information security governance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a full security program based on ISO 27001
Why it's wrong here
Full ISO 27001 is resource-intensive and not feasible for a small business.
- ✓
Hire a virtual CISO and outsource security operations
Why this is correct
This provides governance oversight and operational capability cost-effectively.
- ✗
Ignore security until a breach occurs
Why it's wrong here
This is irresponsible and violates governance principles.
- ✗
Delegate security to the IT manager with periodic board updates
Why it's wrong here
The IT manager may lack governance authority and resources.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.