Transitioning from Compliance to a Risk-Based Security Program Strategy
You are the information security program manager at a global financial services firm. The firm has a mature security program, but the CISO is concerned that the program is not keeping pace with emerging threats such as supply chain attacks and advanced persistent threats (APTs). Additionally, the program currently focuses heavily on compliance with regulations (e.g., PCI DSS, GDPR) rather than proactive risk management. The board wants to see a more strategic approach to information security. However, the compliance team is large and influential, and they resist changes that might reduce their role. You have been asked to propose a new program model that addresses these concerns while maintaining regulatory compliance. What should you do?
Quick Answer
The correct choice is to evolve the program to a risk-based approach that integrates threat intelligence and adapts controls dynamically, while keeping compliance as a baseline. This directly addresses the CISO’s concern about transitioning from a compliance-heavy posture to proactive risk management by using real-time threat data to prioritize and adjust security controls against emerging threats like supply chain attacks and APTs, rather than simply checking regulatory boxes. On the CISM exam, this scenario tests your understanding of the core shift from a static, compliance-driven program to a dynamic, risk-based security program strategy—a key domain in information security governance. A common trap is choosing to expand compliance coverage, which only deepens the reactive cycle, or restructuring the compliance team, which creates political friction without solving the technical gap. Remember the memory tip: “Compliance is the floor, not the ceiling; risk intelligence builds the walls.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Evolve the program to a risk-based approach that integrates threat intelligence and adapts controls dynamically, while keeping compliance as a baseline.
Evolving the program to a risk-based approach (Option D) integrates threat intelligence and dynamically adapts controls, directly addressing the need for proactive management of emerging threats while maintaining compliance as a baseline. This balances strategic evolution with the compliance team's continued role. Option A (restructuring the compliance team) risks political friction and does not inherently shift to risk management. Option B (expanding compliance coverage) increases focus on compliance, not proactive risk. Option C (increasing awareness training) is too narrow and does not address the program's strategic direction.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restructure the compliance team into a risk management function.
Why it's wrong here
Dissolving the compliance function into risk management sacrifices the dedicated regulatory expertise needed to maintain PCI DSS and GDPR obligations, and provokes the resistance the stem warns about. It is tempting because integrating compliance into risk management is a recognised target state once proactive risk processes already exist and compliance duties can be absorbed without loss.
- ✗
Expand the compliance team to cover more regulations and increase auditing frequency.
Why it's wrong here
Expanding the compliance team deepens the regulation-driven focus the CISO wants to move away from, leaving supply chain and APT exposure unaddressed. It is tempting because scaling compliance genuinely strengthens audit readiness and regulatory coverage, which would be the right response if the board's sole concern were passing PCI DSS and GDPR assessments.
- ✗
Increase security awareness training across the organization.
Why it's wrong here
Awareness training changes user behaviour and does nothing to shift the programme from compliance-driven to risk-driven governance, so it fails the strategic requirement. It is tempting because training is a familiar control, and it would be correct when addressing phishing susceptibility or human-factor risk.
- ✓
Evolve the program to a risk-based approach that integrates threat intelligence and adapts controls dynamically, while keeping compliance as a baseline.
Why this is correct
A risk-based model prioritises controls by likelihood and business impact, using threat intelligence to address supply chain attacks and APTs, and adapts dynamically as the threat landscape shifts. Compliance remains the baseline, so PCI DSS and GDPR obligations are still met while the programme becomes proactive rather than checklist-driven.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A large financial institution is maturing its information security program and wants to move from a reactive to a proactive posture. Which of the following initiatives would best support this transition?
hard- A.Deploy an automated compliance monitoring tool.
- B.Implement a bug bounty program to uncover vulnerabilities.
- ✓ C.Establish a threat intelligence unit that analyzes adversary tactics and shares indicators across the organization.
- D.Increase the number of security operations center (SOC) analysts.
Why C: Establishing a threat intelligence unit directly supports a proactive posture by enabling the organization to anticipate and prepare for emerging threats based on adversary tactics, techniques, and procedures (TTPs). Unlike reactive measures, this initiative shifts focus from responding to incidents to preventing them by sharing actionable indicators across the enterprise, aligning with the CISM goal of maturing the security program toward proactive risk management.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.