easyMultiple ChoiceObjective-mapped
CISM Practice Question: Plans to implement ISO/IEC 27001 to formalize its…
An organization plans to implement ISO/IEC 27001 to formalize its information security management system. Which step is most critical to ensure successful implementation?
⚠ Common exam trap
Test-takers frequently choose 'Conduct a comprehensive risk assessment' because it is the technical heart of ISO 27001, but CISM emphasizes that governance and management commitment must precede any technical or operational activities for the ISMS to be sustainable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Obtain commitment from top management
ISO/IEC 27001 requires top management to demonstrate leadership and commitment (Clause 5.1) as the foundation for the entire ISMS. Without executive buy-in, resources, authority, and cross-functional support are lacking, making risk assessments, policies, and training ineffective. The standard mandates management approval for the information security policy and ensures alignment with business objectives, which is the most critical success factor.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct a comprehensive risk assessment
Why it's wrong here
Risk assessment is a core requirement but depends on management support.
- ✓
Obtain commitment from top management
Why this is correct
Top management involvement provides necessary resources and authority for the ISMS.
- ✗
Develop detailed information security policies
Why it's wrong here
Policies are part of implementation, but management commitment is foundational.
- ✗
Train all employees on security awareness
Why it's wrong here
Training is important but not the first critical step.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.