10 of 85 questions · Page 2/2 · Cism Governance topic · Answers revealed
An organization is implementing a new security policy. Which step should occur AFTER the policy is approved?
After approval, the policy must be communicated and trained.
Why this answer
After approval, training and awareness are essential to ensure employees understand and comply with the policy.
An organization is designing a security metrics dashboard for the board of directors. Which THREE metrics are most appropriate for board-level reporting?
Indicates vulnerability management posture.
Why this answer
These metrics provide strategic insight into security effectiveness and compliance.
An organization has a decentralized governance model with security teams embedded in each business unit. The CISO is concerned about inconsistent security controls across the enterprise. What is the BEST recommendation to address this?
Hybrid model enforces standards while allowing local flexibility.
Why this answer
A hybrid model combines the benefits of centralized oversight with decentralized execution, ensuring consistency while maintaining business unit flexibility.
Which TWO regulations are MOST likely to impact an organization that processes credit card payments and handles personal data of EU residents?
GDPR protects personal data of individuals in the EU.
Why this answer
PCI DSS applies to payment card processing, and GDPR applies to personal data of EU residents. These are the two most relevant regulations.
A security policy is being developed. Which THREE steps are part of the policy development lifecycle? (Select THREE)
Drafting is the core step in policy creation.
Why this answer
The lifecycle includes analysis, consultation, drafting, review, approval, training, and monitoring.
An organization is updating its information security strategy. Which THREE elements should be included to ensure alignment with business objectives? (Select THREE)
Risk appetite guides security investments and priorities.
Why this answer
Strategy must be driven by business needs, risk appetite, and regulatory requirements.
A CISO is developing a security strategy. Which THREE elements should be included in a multi-year security roadmap?
Milestones help track progress and ensure the roadmap is actionable.
Why this answer
A roadmap should include milestones, resource allocation, and alignment with business objectives to guide implementation over time.
An organization is subject to GDPR, PCI DSS, and SOX. What is the BEST approach to manage compliance with multiple regulations?
A unified framework streamlines compliance and reduces overlap.
Why this answer
A unified compliance framework that maps common controls to multiple regulations reduces duplication and cost.
Which capability maturity model (CMM) level is characterized by security processes being standardized and documented across the organization?
Level 3 processes are standardized and documented organization-wide.
Why this answer
CMM Level 3 (Defined) involves standardized, documented processes.
An organization is designing a policy exception management process. Which THREE elements are critical for this process to be effective?
Ensures consistent decision-making and oversight.
Why this answer
Effective exception management requires formal documentation, time limits, and review by appropriate authority to prevent misuse.
Ready to test yourself?
Try a timed practice session using only Cism Governance questions.