CISM Information Security Program Practice Question
An information security program must include elements to ensure continuous improvement. Which TWO of the following are MOST essential for continuous improvement?
⚠ Common exam trap
The trap is confusing operational activities (patching, training) with the strategic feedback mechanisms (annual risk assessment, post-incident review) that are required for continuous improvement in an information security program as per CISM's governance framework.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Annual risk assessment
Annual risk assessments are essential for continuous improvement because they systematically identify, evaluate, and prioritize changes in the threat landscape, business objectives, and regulatory requirements. This process ensures the information security program adapts to new risks and aligns with organizational goals, driving iterative enhancements. Without a periodic risk assessment, the program would lack a data-driven foundation for prioritizing improvements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Annual risk assessment
Why this is correct
Risk assessment identifies evolving threats and areas for improvement.
- ✗
Quarterly board meetings
Why it's wrong here
Board meetings are governance, not a continuous improvement process.
- ✗
Monthly patching
Why it's wrong here
Patching is a routine operational activity, not a continuous improvement mechanism.
- ✓
Post-incident reviews
Why this is correct
Post-incident analysis provides actionable insights to enhance controls.
- ✗
Regular security awareness training
Why it's wrong here
Training is for maintaining awareness, not directly for program improvement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.