CISM Information Security Programme Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  To embed security advocates within development teams to improve secure coding practices

  Why this is correct

  Security champions are developers who remain embedded in their teams while receiving extra security training, so secure coding practises are applied during development rather than retrofitted. This distributes security expertise into delivery teams, satisfying the aim of improving secure coding at source.

• ✗

  To conduct security awareness training for all employees

  Why it's wrong here

  Champions receive deeper, role-specific enablement and then embed secure practises in their teams; organisation-wide awareness training is delivered separately to every employee. It is tempting because champions do raise awareness locally, but the programme targets a selected cohort rather than the whole workforce, so it cannot be the primary purpose.

• ✗

  To provide a career path for security professionals

  Why it's wrong here

  The programme builds a network of non-security staff who champion secure practises within their own teams; it is not a progression framework, and champions typically remain in their primary roles. It is tempting because participation can enhance a CV, but career development is a by-product, not the initiative's primary purpose.

• ✗

  To replace the need for a dedicated security team

  Why it's wrong here

  Security champions are embedded advocates who extend the security team's reach into development and business units; they supplement rather than replace dedicated specialists, who retain ownership of policy, architecture and incident response. The option is tempting because champions do absorb some triage and awareness duties, but eliminating the security function removes the expertise the programme depends on.

Go deeper

Related to this question