CISM Information Security Governance Practice Question
An organization is developing an information security strategy aligned with business objectives. Which of the following is the BEST approach to prioritize security investments?
⚠ Common exam trap
CISM often tests whether candidates default to 'industry best practice' or 'cost' as the primary driver, when the ISACA-endorsed answer is always risk-based alignment with business objectives.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a risk-based approach aligned to business impact
A risk-based approach aligned to business impact ensures security investments target the threats and assets that matter most to organizational objectives. This ties spending directly to likelihood and consequence of risk, which is the CISM-endorsed way to prioritize finite security budgets. It balances cost, threat, and business value rather than treating all domains equally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Follow industry benchmarks without adjustment
Why it's wrong here
Unadjusted benchmarks reflect other organisations' risk profiles, not this business's objectives, so spending misses its own critical exposures. It is tempting because benchmarks offer ready-made justification, and it would be correct as a starting reference once tailored through the organisation's own risk assessment.
- ✓
Use a risk-based approach aligned to business impact
Why this is correct
A risk-based approach ranks investments by likelihood and business impact, so funding flows to exposures threatening the objectives in the stem. It ties security spend to measurable business consequence rather than technical severity alone, satisfying the alignment requirement while remaining defensible to executive stakeholders.
- ✗
Prioritize based on the cost of security controls
Why it's wrong here
Cost alone ignores which assets carry the greatest business risk, so investments may fund cheap controls protecting low-value systems. It is tempting because budgeting demands cost awareness, and it would be correct when comparing competing controls that address an already-agreed, risk-ranked set of gaps.
- ✗
Allocate budget equally across all security domains
Why it's wrong here
Equal allocation ignores risk exposure and business impact, so funding is not directed where it reduces the greatest risk to business objectives. It is tempting because it appears fair and avoids internal disputes over budget, and it would be correct only where all domains carried identical risk, which is never the case.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.