CISM Information Security Program Practice Question
A small business owner wants to establish an information security program but has limited budget and staff. Which of the following frameworks would be most appropriate to guide the program?
⚠ Common exam trap
Many exam-takers choose ISO/IEC 27001 because it is the most well-known security standard, but they overlook its heavy documentation and certification requirements, which are impractical for a small business with limited budget and staff.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NIST Cybersecurity Framework
The NIST Cybersecurity Framework (CSF) is the most appropriate choice because it is designed to be flexible and scalable, allowing small businesses with limited budget and staff to implement a risk-based information security program using a prioritized, outcome-driven approach. Unlike ISO/IEC 27001, which requires formal certification and extensive documentation, or COBIT 2019, which is geared toward enterprise IT governance, the NIST CSF provides a customizable set of core functions (Identify, Protect, Detect, Respond, Recover) that can be adopted incrementally without heavy resource investment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ISO/IEC 27001
Why it's wrong here
Full certification requires significant resources.
- ✓
NIST Cybersecurity Framework
Why this is correct
Flexible and adaptable, with tiers for maturity.
- ✗
COBIT 2019
Why it's wrong here
Broader IT governance framework, less security-focused.
- ✗
PCI DSS
Why it's wrong here
Industry-specific, not general.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.