Question 593 of 871
CISM Information Security Program Practice Question
During a merger, the acquiring company's security program must integrate with the target company's program. What is the HIGHEST priority action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct a comprehensive risk assessment of the target
A comprehensive risk assessment of the target company's environment identifies integration risks and informs the integration plan. Option A is premature without understanding risks. Option C and D are tactical steps that should follow risk assessment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Consolidate all security tools
Why it's wrong here
Tool consolidation is a later step after risk assessment and planning.
- ✓
Conduct a comprehensive risk assessment of the target
Why this is correct
Risk assessment provides the basis for all integration decisions.
- ✗
Merge the security teams into one reporting structure
Why it's wrong here
Structural changes should follow understanding of risks and needs.
- ✗
Standardize security policies immediately
Why it's wrong here
Standardization without risk assessment may overlook critical differences.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. After a data breach, the CISO reviews the security program. The breach exploited a known vulnerability in a legacy system that was deemed 'acceptable risk' two years ago. What should the CISO do to improve the program?
hard- A.Establish a policy that legacy systems must be upgraded annually.
- B.Disconnect the legacy system from the network immediately.
- ✓ C.Implement a process for periodic reassessment of accepted risks.
- D.Require immediate remediation of all legacy systems.
Why C: Risk acceptance is not a one-time decision; it must be periodically reassessed to account for changes in the threat landscape, business context, or compensating controls. The breach exploited a known vulnerability that was accepted two years ago, indicating the risk environment has shifted (e.g., new exploit code, increased attacker interest). Implementing a periodic reassessment process ensures that accepted risks are re-evaluated against current threats and vulnerabilities, allowing the organization to either renew acceptance, apply mitigations, or retire the system.
Last reviewed: Jun 24, 2026
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.