CISM Steering committee primary role? Practice Question
Which of the following is the PRIMARY responsibility of a steering committee in an information security program?
⚠ Common exam trap
A common mix-up: candidates confuse the steering committee's strategic oversight role with the tactical or operational duties of other roles, such as the CISO or security analysts, leading them to select options like approving policies or conducting assessments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Providing strategic direction and oversight
The steering committee's primary role is to provide strategic direction and oversight for the information security program, ensuring alignment with business objectives and risk appetite. This includes approving the overall security strategy, budget, and major initiatives, rather than engaging in operational tasks like policy drafting or technical assessments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Approving individual security policies
Why it's wrong here
Policy approval is an operational task, not the primary strategic role of the steering committee.
- ✗
Conducting vulnerability assessments
Why it's wrong here
Technical assessments are performed by operational teams, not the steering committee.
- ✗
Implementing security controls
Why it's wrong here
Implementation is an operational responsibility, not a steering committee function.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CISM exam frequently reuses these exact scenarios with slightly different constraints.
✓Providing strategic direction and oversightCorrect answer▾
✗Approving individual security policiesWrong answer — click to see why▾
Why this is wrong here
Policy approval is an operational task, not the primary strategic role of the steering committee.
✗Conducting vulnerability assessmentsWrong answer — click to see why▾
Why this is wrong here
Technical assessments are performed by operational teams, not the steering committee.
✗Implementing security controlsWrong answer — click to see why▾
Why this is wrong here
Implementation is an operational responsibility, not a steering committee function.
Analysis generated from the official CISMblueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.