CISM Information Security Programme Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  List all planned technology purchases

  Why it's wrong here

  A purchase list states what would be bought, not the risk reduced or business outcome delivered, so executives lack justification to release funds. It is tempting because it is concrete and simple to compile, and it is the right artefact once funding is approved for procurement planning, but approval needs a business case linking spend to risk treatment.

• ✗

  Describe the latest cyber threats

  Why it's wrong here

  Describing threats raises awareness but does not connect them to the organisation's specific exposure, likelihood or financial impact, so it cannot justify a figure. Threat briefings are tempting because they are dramatic and readily available, and they belong in security awareness training, but budget approval demands quantified risk and cost-benefit analysis against business objectives.

• ✓

  Present ROI analysis showing breach avoidance savings

  Why this is correct

  Quantifying avoided breach costs in monetary terms translates security spend into the financial language executives use for capital allocation. Demonstrating return on investment directly addresses the approval criterion of business value, making the case more persuasive than technical or compliance-based arguments alone.

• ✗

  Show industry benchmarks for security spending

  Why it's wrong here

  Industry spending benchmarks compare peers, not the organisation's own risk exposure or control gaps, so they give executives no basis to approve funding. Benchmarks are tempting because they are easy to source and frame spending as normal, and they suit maturity assessments or board reporting, but budget approval requires quantified risk reduction tied to business objectives.

Go deeper

Related to this question