CISM Information Security Programme Practice Question
When selecting security controls, a company must prioritize which controls first?
⚠ Common exam trap
Test-takers frequently confuse cost or ease of implementation with risk priority — CISM candidates often pick the 'practical' answer instead of the risk-based governance answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Controls that address the highest risks and are critical to business operations
Controls should be prioritized based on their ability to address the highest risks and support critical business operations. CISM emphasizes a risk-based approach where resources are allocated to mitigate the most significant threats first, ensuring that security investments align with business objectives and risk appetite. This prevents wasted effort on low-impact controls while critical exposures remain unaddressed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Controls that are least expensive
Why it's wrong here
Cost is a business constraint, not a risk criterion; controls are prioritised by the risk each mitigates, so cheap controls addressing low risks would be funded before critical exposures. Cost-effectiveness matters when comparing competing controls for the same identified risk, which is a later step than this prioritisation.
- ✗
Controls that are easiest to implement
Why it's wrong here
Ease of implementation is not a risk criterion; controls must first address the highest-risk exposures identified in the risk assessment. It is tempting because quick wins show progress, but prioritising by convenience can leave critical vulnerabilities untreated while effort is spent on low-impact controls.
- ✗
All controls from the chosen framework equally
Why it's wrong here
Framework controls carry differing relevance to the organisation's own risk profile, so treating them equally ignores the risk-based prioritisation the selection process requires. Implementing a framework in full is appropriate for compliance-driven adoption, where complete coverage of a mandated baseline is the actual objective.
- ✓
Controls that address the highest risks and are critical to business operations
Why this is correct
Prioritisation follows risk magnitude and business dependency, so controls mitigating the highest risks to critical operations come first. This satisfies the stem's prioritisation constraint by directing finite budget and effort where residual exposure and potential operational disruption are greatest, rather than to low-impact or compliance-only controls.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.