CISM Information Security Programme Practice Question
Which control selection framework includes implementation groups (IG1, IG2, IG3) that help organizations prioritize controls based on their risk profile?
⚠ Common exam trap
CISM often tests framework-specific terminology; candidates confuse NIST SP 800-53 baselines (Low/Moderate/High) with CIS Implementation Groups (IG1/IG2/IG3) and select the wrong framework.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CIS Controls v8
CIS Controls v8 is the framework that introduced Implementation Groups (IG1, IG2, IG3) to help organizations prioritize safeguards based on risk profile and resources. IG1 covers essential cyber hygiene, IG2 adds controls for organizations with sensitive data, and IG3 provides advanced controls for high-security environments. This tiered approach is a defining feature of CIS Controls v8.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
CIS Controls v8
Why this is correct
CIS Controls v8 organises safeguards into Implementation Groups IG1, IG2 and IG3, enabling organisations to prioritise based on risk profile and resources. This tiered structure is unique to CIS Controls, directly matching the framework the stem describes.
- ✗
COBIT 2019
Why it's wrong here
COBIT 2019 provides governance and management objectives across five domains with maturity and capability levels, not IG1–IG3 implementation groups. Those groups are defined in the CIS Critical Security Controls. COBIT would be correct when the question concerns IT governance framework design and process capability assessment.
- ✗
NIST SP 800-53
Why it's wrong here
NIST SP 800-53 catalogues controls across baselines (Low, Moderate, High) tied to FIPS 199 impact categorisation, not IG1–IG3. Implementation groups are the CIS Critical Security Controls' prioritisation mechanism. SP 800-53 would be correct for federal control baselines and RMF authorisation packages.
- ✗
ISO 27001 Annex A
Why it's wrong here
ISO 27001 Annex A lists 93 controls in four themes with no implementation groups; prioritisation there comes from the organisation's own risk assessment and Statement of Applicability. Implementation groups IG1–IG3 belong to the CIS Critical Security Controls. Annex A would fit a question about certification scope controls.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.