easyMultiple ChoiceObjective-mapped
CISM Practice Question: An information security manager is asked to…
An information security manager is asked to report on the effectiveness of the security program. Which metric would BEST indicate governance effectiveness?
⚠ Common exam trap
Many candidates confuse operational or tactical metrics (like vulnerability counts, audit findings, or incident response times) with governance metrics, which must demonstrate strategic alignment and value to the business.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Percentage of security initiatives directly linked to business strategy
Governance effectiveness is measured by how well the security program aligns with and supports business objectives. Option A directly reflects this alignment by showing the percentage of security initiatives tied to business strategy, which is a key indicator of strategic governance rather than operational or tactical performance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Percentage of security initiatives directly linked to business strategy
Why this is correct
Directly measures governance alignment.
- ✗
Number of critical vulnerabilities identified
Why it's wrong here
Technical metric, not governance.
- ✗
Number of audit findings per quarter
Why it's wrong here
Compliance metric.
- ✗
Mean time to detect and respond to incidents
Why it's wrong here
Measures operational efficiency.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.