75 of 85 questions · Page 1/2 · Cism Governance topic · Answers revealed
Which capability maturity model (CMM) level indicates that security processes are proactively measured and optimized?
Level 5 focuses on continuous improvement and optimization based on metrics.
Why this answer
Level 5 (Optimizing) focuses on continuous improvement through quantitative measurement.
A CISO is building a business case for a new security tool. Which approach BEST quantifies the value of the investment?
This directly links investment to avoided losses.
Why this answer
Comparing the cost of the tool against the average cost of a data breach (e.g., $4.35M) provides a clear financial justification.
An organization is updating its security governance framework. Which three elements are essential for ensuring board-level oversight?
Committee provides dedicated oversight.
Why this answer
These three elements ensure the board can fulfill its oversight role effectively.
During a security policy development lifecycle, which step should occur immediately after 'drafting' the policy?
Legal review follows drafting to ensure legal validity.
Why this answer
After drafting, legal review ensures compliance with laws and regulations.
A security manager wants to measure the effectiveness of the security awareness program. Which metric is most relevant?
Correct: Direct measure of user behavior.
Why this answer
Phishing simulation click rate directly measures user behavior change, a key indicator of awareness effectiveness.
A CISO reports to the CIO and provides regular security updates to the board audit committee. The CEO has delegated security accountability to the CFO. Which governance structure does this reflect?
Correct: CISO to CIO, board updates, CFO accountable.
Why this answer
This structure shows the CISO reporting to CIO (dotted line to board), with executive accountability assigned to CFO, typical of a tiered governance model.
Which of the following is the PRIMARY responsibility of the CISO in an organization?
The CISO leads the security strategy and programme.
Why this answer
The CISO is accountable for developing and maintaining the information security strategy and programme.
What is the primary purpose of a security incident near-miss reporting culture?
Correct: Proactive improvement.
Why this answer
Encouraging reporting of near misses helps identify weaknesses and prevent future incidents.
Which of the following is the correct order in the security policy hierarchy, from highest to lowest level?
This is the correct hierarchical order.
Why this answer
Enterprise policy sets the tone, followed by standards, then procedures, then guidelines.
Which TWO factors are most important when prioritizing security investments? (Select TWO.)
Risk reduction directly impacts security posture.
Why this answer
Risk reduction and alignment with business strategy ensure investments address the most critical needs and support organizational goals.
A CISO is preparing a multi-year security roadmap. Which of the following is the MOST critical factor for ensuring the roadmap aligns with business strategy?
Directly linking roadmap to business objectives ensures relevance and executive support.
Why this answer
Understanding business objectives first ensures that security initiatives support the organization's goals and are prioritized accordingly.
Which component is essential for building a strong security culture within an organization?
Leadership commitment drives culture.
Why this answer
Executive sponsorship demonstrates leadership commitment and sets the tone at the top.
Which metric best indicates the effectiveness of a security awareness program in changing employee behavior?
Directly measures employee behavior.
Why this answer
Phishing simulation click rates directly measure how employees respond to a common threat.
A CISO is reporting to the board of directors. Which metric would BEST demonstrate the effectiveness of the security program in reducing business impact?
This metric quantifies the financial benefit of security spending.
Why this answer
Security investment vs. loss avoidance directly links spending to prevented losses, demonstrating ROI and program effectiveness to the board.
An organization is updating its security policy framework. The current enterprise security policy has not been reviewed in three years. What is the FIRST step in the policy development lifecycle?
A gap analysis identifies what needs to change based on new regulations, business changes, or incident lessons.
Why this answer
The policy lifecycle begins with a gap analysis to identify deficiencies between current policies and business/regulatory requirements.
A security manager is conducting a regulatory compliance review. Which THREE regulations are most likely to apply to a financial services company operating in the United States?
Applies to financial reporting controls.
Why this answer
SOX applies to financial reporting, PCI DSS to payment cards, and sector-specific regulations may apply; GDPR is EU-specific.
An organization has a decentralized governance model where each business unit manages its own security. What is a key challenge of this model?
Without central oversight, policies can vary widely.
Why this answer
Decentralized models often lead to inconsistent security practices and lack of standardization across the organization.
An organization is implementing a hybrid governance model for information security. Which statement best describes this approach?
Hybrid combines central direction with local execution.
Why this answer
Hybrid combines centralized oversight with decentralized execution within business units.
Which capability maturity model (CMM) level indicates that security processes are managed and measured using quantitative metrics?
Managed uses quantitative measures.
Why this answer
Level 4 (Managed) is characterized by quantitative management of processes.
Which capability maturity model (CMM) level indicates that security processes are measured and controlled?
Correct: Quantitative measurement and control.
Why this answer
Level 4 (Managed) involves quantitative measurement and control of processes.
A company is considering a policy exception that would allow temporary non-compliance with a data encryption standard due to a legacy system. What is the most important element of the exception management process?
This ensures the exception is temporary and risks are accepted.
Why this answer
Exceptions must include a documented remediation plan and risk acceptance to ensure accountability.
Which governance structure is characterized by a single security team that serves the entire organization?
Centralized uses a single security team for the whole organization.
Why this answer
A centralized governance model consolidates security responsibilities under one team, ensuring consistent policy enforcement and resource allocation.
Which regulatory requirement mandates that organizations implement data protection measures for personal data of EU citizens?
Correct: General Data Protection Regulation.
Why this answer
GDPR is the primary regulation for personal data protection in the EU.
Which of the following is the PRIMARY reason for aligning the information security program with business objectives?
Demonstrating value and gaining support is essential for long-term sustainability.
Why this answer
Aligning security with business objectives ensures that security investments support business goals and demonstrate value to stakeholders.
A multinational organization must comply with GDPR, CCPA, and PCI DSS. The security manager is designing a compliance monitoring program. Which approach is MOST efficient?
Control mapping leverages overlaps for efficiency.
Why this answer
Mapping controls to multiple regulations reduces duplication and ensures comprehensive coverage across requirements.
Which of the following is the PRIMARY benefit of having a formal policy exception management process?
Formal process ensures exceptions are managed consistently and risks are accepted by appropriate authority.
Why this answer
A formal process ensures that exceptions are documented, reviewed, and approved, reducing uncontrolled risk.
A CISO is reporting to the board on the effectiveness of the security programme. Which TWO metrics are MOST appropriate for board-level reporting? (Select TWO)
These reflect the effectiveness of detection and response capabilities.
Why this answer
Board-level metrics should focus on strategic impact, such as overall risk posture and financial implications.
An organization's security strategy includes a goal to achieve CMM Level 3. What capability does the organization need to demonstrate?
Correct: Level 3 requires standardization.
Why this answer
Level 3 (Defined) requires standardized, documented processes across the organization.
An organization is developing a security policy for remote access. According to the policy hierarchy, where should this policy fit?
Standards define mandatory requirements for specific domains.
Why this answer
Enterprise security policy is high-level; domain-specific standards provide mandatory requirements for specific areas like remote access.
A CISO is preparing a business case for a new security investment. Which TWO elements are most important to include to justify the investment?
Quantifies potential savings by avoiding breaches.
Why this answer
Risk reduction value and breach cost avoidance directly quantify the benefits.
A multinational organization handles personal data of EU residents. Which regulatory requirement must the information security program address?
GDPR protects personal data of EU residents.
Why this answer
GDPR applies to any organization processing personal data of EU residents, regardless of location.
A policy exception management process allows a business unit to temporarily deviate from a security policy. What is the MOST important requirement for such an exception?
Compensating controls reduce risk to an acceptable level.
Why this answer
Compensating controls are essential to mitigate the risk of the exception, ensuring the organization's risk posture is acceptable.
A CISO is presenting a security investment proposal to the board. Which two metrics are most effective for articulating the business value of the investment?
Measures financial benefit of preventing breaches.
Why this answer
Breach cost avoidance directly quantifies risk reduction, and compliance cost avoidance shows regulatory value.
A CISO is building a business case for a new security tool. Which approach BEST articulates the return on investment (ROI) to the board?
This shows net benefit (ROI) by comparing risk reduction to cost.
Why this answer
Risk reduction value quantifies the expected reduction in loss, which directly ties to business value.
An organization's board of directors wants to improve security culture. Which initiative would have the GREATEST impact?
Executive sponsorship signals priority and accountability.
Why this answer
Executive sponsorship from the board demonstrates top-down commitment, which is critical for driving cultural change.
An organization is implementing a policy exception management process. Which THREE elements are essential for effective exception handling? (Select THREE.)
Periodic review ensures exceptions remain valid.
Why this answer
Effective exception management requires documentation, approval, and periodic review to prevent exceptions from becoming permanent risks.
A CISO is developing a multi-year security roadmap aligned with business strategy. The organization is in a highly regulated industry with frequent regulatory changes. Which of the following should be the PRIMARY driver for prioritizing security initiatives?
Regulatory compliance is a critical business requirement; non-compliance can result in fines, legal action, and reputational damage.
Why this answer
While risk reduction is important, in a highly regulated environment with frequent changes, compliance alignment ensures the organization avoids legal penalties and maintains business continuity.
An organization is implementing a security culture measurement program. Which THREE metrics would BEST indicate a positive security culture?
High completion shows engagement and commitment to security.
Why this answer
A positive culture is reflected in proactive reporting, low error rates, and high engagement. Near miss reporting, training completion, and low human error incidents are key indicators.
A CISO is building a business case for a new security tool. Which of the following approaches is MOST effective for justifying the investment?
This approach quantifies risk reduction and shows financial benefit.
Why this answer
Quantifying risk reduction in monetary terms directly links security investment to business value and risk management.
Which of the following is the PRIMARY role of the board of directors in information security governance?
Board oversight is a key governance responsibility.
Why this answer
The board sets the tone from the top and ensures security is integrated into organizational strategy and risk management.
Which of the following is the primary responsibility of the board of directors in information security governance?
Board sets risk appetite and provides oversight.
Why this answer
The board is responsible for oversight, ensuring security aligns with business strategy and risk appetite.
An organization is deciding whether to adopt a centralized or hybrid security governance model. Which factor MOST strongly favors a hybrid model?
Hybrid balances central control with unit flexibility.
Why this answer
A hybrid model allows business units to maintain some autonomy while benefiting from central standards and oversight.
A multinational organization must comply with GDPR, CCPA, and PCI DSS. Which approach is MOST effective for managing these overlapping requirements?
A unified framework streamlines compliance and reduces redundancy.
Why this answer
A unified compliance framework reduces duplication and ensures consistent control application across regulations.
An organization's board of directors wants to ensure that security activities align with business objectives. Which governance practice best supports this alignment?
Correct: Roadmap explicitly aligns with business objectives.
Why this answer
A security strategy that directly references business goals ensures that security investments and initiatives support organizational priorities.
Which of the following is the PRIMARY responsibility of the board of directors regarding information security governance?
The board provides strategic direction and oversight, ensuring alignment with business goals.
Why this answer
The board is responsible for ensuring that information security is aligned with business objectives and that adequate resources are allocated.
Which of the following best describes a key benefit of a centralized information security governance model?
Centralization ensures uniformity.
Why this answer
Centralized models provide consistent application of controls and policies across the organization.
Which of the following is the BEST example of a board-level security metric?
This metric helps the board understand the return on security investments and the value of preventing losses.
Why this answer
Board-level metrics should reflect impact on business objectives and financial performance. Investment vs. loss avoidance directly ties security spending to business value.
Which of the following is the FIRST step in the security policy development lifecycle?
Gap analysis determines what policies are needed.
Why this answer
A gap analysis identifies current state vs. desired state, which is necessary before drafting policy.
Which TWO elements are key components of a security culture measurement program?
Indicates user awareness and behavior.
Why this answer
Phishing simulation click rates and training completion rates are common quantitative measures of security culture.
A CISO is presenting a security metrics dashboard to the board. Which TWO metrics are most appropriate for board-level reporting? (Select TWO.)
Demonstrates ROI and is strategic.
Why this answer
Board-level metrics should focus on strategic outcomes such as incident response and financial impact.
A security metrics program should include key performance indicators (KPIs) for board reporting. Which metric is most appropriate for executive oversight?
MTTD is a strategic metric for board visibility.
Why this answer
Mean time to detect is a high-level metric that reflects security effectiveness.
An organization is developing an information security strategy aligned with business objectives. Which of the following is the BEST approach to prioritize security investments?
Risk-based prioritization ensures investments address the highest risks.
Why this answer
A risk-based approach aligns security investments with the organization's risk appetite, ensuring resources are directed to the most critical areas.
An organization is updating its security policies. After drafting the policy, which step should occur NEXT?
Legal review is the next logical step.
Why this answer
Legal review ensures the policy complies with applicable laws and regulations before seeking approval.
A security awareness programme is being evaluated. Which metric BEST indicates a positive security culture?
Lower click rates indicate better security awareness and culture.
Why this answer
A low click rate on simulated phishing emails indicates that employees are cautious and apply training.
Which board-level metric is MOST useful for measuring the effectiveness of the incident response process?
MTTR indicates how quickly the organization responds to incidents.
Why this answer
Mean time to respond (MTTR) directly measures how quickly incidents are contained and remediated.
A CISO is building a business case for a new security tool. Which TWO metrics would BEST justify the investment to senior leadership?
Shows how the tool reduces costs related to regulatory compliance (e.g., fines, audits).
Why this answer
Senior leadership cares about financial impact. Breach cost avoidance and compliance cost avoidance directly demonstrate value by reducing potential losses.
What is the first step in the security policy development lifecycle?
Correct: Identifies needs first.
Why this answer
Gap analysis identifies missing or inadequate controls before drafting new policies.
Which governance model is characterized by a single, centralized security team that serves the entire organization?
Correct: Single team serves entire organization.
Why this answer
Centralized governance consolidates security resources and authority under one team, ensuring consistent policy enforcement and streamlined management.
A financial services firm is subject to SOX, PCI DSS, and GDPR. The CISO needs to implement a regulatory change management process. Which THREE steps are essential?
Determines required adjustments.
Why this answer
Monitoring regulatory changes, assessing impact, and updating controls are critical to maintaining compliance.
A CISO is designing a security metrics program for the board. Which TWO metrics are MOST appropriate for board-level reporting?
Demonstrates financial ROI.
Why this answer
Mean time to respond (MTTR) and security investment vs. loss avoidance are strategic metrics that inform risk management and resource allocation.
Which TWO components are essential for an effective information security governance framework?
Governance requires board accountability and oversight to ensure security is prioritized.
Why this answer
Board-level oversight and alignment with business objectives are foundational to governance, ensuring security is integrated into organizational strategy.
Which of the following is the FIRST step in the security policy development lifecycle?
Gap analysis identifies what policies are needed.
Why this answer
The lifecycle begins with gap analysis to identify missing or outdated policies before drafting or approval.
A CISO is developing a multi-year security roadmap. Which approach best ensures the roadmap aligns with business strategy?
Directly aligning ensures security supports business.
Why this answer
Roadmaps should be derived from business objectives to ensure relevance and executive support.
An organization has a decentralized governance model where each business unit manages its own security team. The CISO reports to the CIO. Which of the following is the GREATEST risk associated with this structure?
Decentralized structures often lead to varying levels of security maturity and policy adherence, creating gaps that attackers can exploit.
Why this answer
In a decentralized model, inconsistent security practices across business units can lead to gaps in protection and difficulty in enforcing enterprise-wide standards.
During a policy exception review, the CISO identifies that multiple exceptions have been granted for the same control due to business constraints. What is the best course of action?
Correct: Revising policy addresses root cause.
Why this answer
Addressing root causes reduces reliance on exceptions and strengthens the security posture.
Which of the following is the BEST metric for the board to assess the security program's effectiveness in detecting threats?
MTTD is a standard detection metric.
Why this answer
Mean time to detect (MTTD) directly measures the speed of threat detection, a key indicator of detection capability.
Which board-level committee typically receives security reports to provide oversight?
Correct: Oversees risk and controls.
Why this answer
The audit/risk committee is responsible for oversight of risk management and control, including security.
In a Capability Maturity Model (CMM) for information security processes, which level is characterized by processes being measured and controlled?
Level 4 uses metrics and statistical control to manage processes.
Why this answer
Level 4 (Managed) involves quantitative measurement and control of processes.
A CISO is developing a multi-year security roadmap. Which of the following should be the PRIMARY driver for prioritizing initiatives?
Security must support business goals and risk tolerance.
Why this answer
The roadmap must align security initiatives with the organization's strategic business objectives to ensure relevance and support.
Which of the following best describes the role of the chief information security officer (CISO) in a governance context?
CISO is accountable for security program and reports to executives.
Why this answer
The CISO is responsible for developing and implementing the security program, reporting to executive leadership.
A security manager is measuring the security culture of the organization. Which three metrics are most appropriate?
Measures user susceptibility to phishing.
Why this answer
These metrics directly reflect employee behavior and the effectiveness of the security culture program.
The board of directors has requested a security metrics dashboard. Which metric would BEST demonstrate the effectiveness of the incident response process?
MTTR indicates how quickly incidents are contained and remediated.
Why this answer
Mean Time to Respond (MTTR) directly measures the speed and effectiveness of incident response.
An organization is implementing a security awareness program. Which metric is MOST indicative of a positive security culture?
Indicates proactive security behavior and trust in reporting channels.
Why this answer
A high near-miss reporting rate indicates that employees are vigilant and willing to report potential issues without fear of blame.
In which reporting model does the CISO have a direct reporting line to the CEO while also reporting to the CIO on operational matters?
This structure balances strategic and operational reporting.
Why this answer
A dotted line reporting to the CIO and solid line to the CEO gives the CISO strategic authority while maintaining operational alignment.
A company is developing a business case for a new security tool. Which metric best demonstrates the value of the investment?
Correct: Direct ROI comparison.
Why this answer
Comparing security investment to potential loss avoidance quantifies ROI in business terms.
Ready to test yourself?
Try a timed practice session using only Cism Governance questions.