CISM Information Security Governance Practice Question
An organization has a decentralized governance model with security teams embedded in each business unit. The CISO is concerned about inconsistent security controls across the enterprise. What is the BEST recommendation to address this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Adopt a hybrid governance model with enterprise-wide standards and local execution
A hybrid model combines the benefits of centralized oversight with decentralized execution, ensuring consistency while maintaining business unit flexibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Adopt a hybrid governance model with enterprise-wide standards and local execution
Why this is correct
Hybrid model enforces standards while allowing local flexibility.
- ✗
Conduct a risk assessment to prioritize controls
Why it's wrong here
Risk assessment is important but does not directly address governance inconsistency.
- ✗
Implement a centralized security operations center (SOC) to monitor all units
Why it's wrong here
This addresses monitoring but not the governance inconsistency.
- ✗
Move to a fully centralized governance model
Why it's wrong here
Full centralization may face resistance and reduce business unit agility.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.