CISM Information Security Governance Practice Question

Which governance structure is characterized by a single security team that serves the entire organization?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Centralized

A centralized governance model consolidates security responsibilities under one team, ensuring consistent policy enforcement and resource allocation.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Matrix
Why it's wrong here
A matrix structure assigns security staff to both a central function and business units, producing dual reporting rather than one team serving everyone. It is tempting because it still includes a central security function, but that function coordinates embedded staff instead of being the sole organisation-wide team.
✗
Hybrid
Why it's wrong here
A hybrid structure splits security duties between a central function and business-unit or regional teams, so no single team serves everyone. It is tempting because hybrid governance genuinely fits federated organisations needing local responsiveness alongside central standards, but the stem demands one centralised team covering the whole organisation.
✓
Centralized
Why this is correct
A centralized structure places decision-making authority and the security function within one team serving the whole organisation, directly matching the stem's single-team constraint. This contrasts with decentralized models, where security personnel report into separate business units, and federated hybrids, which distribute control while retaining a coordinating function.
✗
Decentralized
Why it's wrong here
Decentralized embeds security in business units.

Go deeper