CISM Information Security Programme Practice Question
An organization is redesigning its information security program to better align with business objectives. The CISO reports to the CIO, but business leaders feel security decisions are too IT-centric. Which reporting structure would best address this concern?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CISO reports directly to the CEO or Board of Directors.
Reporting to the CEO or Board gives the CISO independence from IT and better alignment with business strategy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CISO reports to the Chief Risk Officer (CRO).
Why it's wrong here
While better than reporting to CIO, it may still not give security a direct voice at the executive level.
- ✗
CISO reports to the Chief Operating Officer (COO).
Why it's wrong here
This may prioritize operational efficiency over security, and does not guarantee business alignment.
- ✓
CISO reports directly to the CEO or Board of Directors.
Why this is correct
Direct reporting to the CEO or Board ensures security is independent and aligned with business objectives.
- ✗
CISO continues reporting to CIO but with a dotted line to the Board.
Why it's wrong here
This still subordinates security to IT, which may not fully address business alignment.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.