easyMultiple ChoiceObjective-mapped
CISM Practice Question: During an internal audit, it was found that the…
During an internal audit, it was found that the security policy does not address the use of personal devices for work. Which governance action should be taken first?
⚠ Common exam trap
The trap here is that candidates often jump to a technical solution (MDM software) or a punitive measure (banning devices) because they focus on immediate risk mitigation, but CISM governance questions test the principle that policy and risk assessment must precede any technical or operational controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Develop a mobile device management policy and conduct a risk assessment
The first governance action should be to develop a mobile device management (MDM) policy and conduct a risk assessment because governance requires establishing a formal framework before implementing technical controls. Without a policy, any subsequent actions (like purchasing MDM software or training) lack a defined scope, risk appetite, and compliance baseline. The risk assessment identifies specific threats (e.g., data leakage via unmanaged devices, lack of encryption) and informs the policy's requirements, aligning with the CISM governance domain's emphasis on policy as the foundation for all security activities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Develop a mobile device management policy and conduct a risk assessment
Why this is correct
This is the proper governance approach: policy first, then technology and training.
- ✗
Train users on security awareness
Why it's wrong here
Training without a policy lacks clear guidance.
- ✗
Purchase MDM software
Why it's wrong here
Technology should follow policy, not precede it.
- ✗
Immediately ban all personal devices
Why it's wrong here
A ban without policy and risk assessment may be impractical and cause resistance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.