hardMultiple ChoiceObjective-mapped
CISM Practice Question: Acme Corp, a global manufacturer, has a…
Acme Corp, a global manufacturer, has a decentralized security governance model. Each business unit manages its own security, resulting in inconsistent policies and repeated audit findings. The new CISO proposes a federated model where a central team sets minimum standards and each unit can add local controls. However, the European unit's head insists on full autonomy due to GDPR strictness. The board is concerned about compliance costs. What should the CISO do first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct a risk assessment to identify where local controls are truly needed
Conducting a risk assessment will identify where local controls are truly necessary and justify the federated model. Option A ignores local concerns. Option B undermines the federation goal. Option D is a tactical fix, not strategic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement the federated model immediately and require all units to comply
Why it's wrong here
This would face resistance and may violate local regulations.
- ✗
Allow the European unit to keep full autonomy while others follow the model
Why it's wrong here
Defeats the purpose of a consistent governance framework.
- ✓
Conduct a risk assessment to identify where local controls are truly needed
Why this is correct
A risk-based approach provides evidence for the federated model.
- ✗
Hire a GDPR expert for the European unit
Why it's wrong here
Addresses only one aspect; does not resolve overall governance.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.