easyMultiple ChoiceObjective-mapped
CISM Practice Question: Is developing its information security strategy
An organization is developing its information security strategy. Which of the following should be the PRIMARY driver for defining security objectives?
⚠ Common exam trap
The trap here is that candidates often select 'regulatory compliance requirements' as the primary driver because they confuse legal necessity with strategic priority, but CISM emphasizes that security governance must be business-driven, not compliance-driven.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Business objectives
Business objectives are the primary driver for defining security objectives because information security exists to enable the organization to achieve its mission and strategic goals. Security objectives must align with and support business objectives to ensure that resources are allocated effectively and that security controls are prioritized based on risk to the business, not just compliance or generic practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Industry best practices
Why it's wrong here
Industry benchmarks guide implementation but not the primary driver.
- ✗
Historical security incidents
Why it's wrong here
Past incidents inform risk management but don't define strategic objectives.
- ✓
Business objectives
Why this is correct
Security strategy must align with and enable business goals.
- ✗
Regulatory compliance requirements
Why it's wrong here
Compliance is a minimum requirement, not the driver for strategic objectives.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.