CISM Information Security Governance Practice Question
Which of the following best describes a key benefit of a centralized information security governance model?
⚠ Common exam trap
CISM often tests the trade-off between centralization and decentralization — candidates who equate 'centralized' with 'better responsiveness' or 'less oversight' pick A, B, or D, missing that consistency of enforcement is the defining benefit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Consistent enforcement of security policies and standards
A centralized information security governance model concentrates policy-making, standards, and oversight in a single function (typically the CISO's office), which produces consistent enforcement of security policies and standards across the entire enterprise. This consistency is the primary benefit because it eliminates the variance and gaps that arise when business units interpret security requirements independently. It also enables uniform risk appetite, metrics, and reporting to the board.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Greater autonomy for business units
Why it's wrong here
Centralisation deliberately removes business-unit autonomy, concentrating policy, risk decisions and standards under one authority; autonomy is the defining trait of a decentralised or federated model. It tempts because federated governance does grant units latitude, which suits highly diverse, regulated-by-region organisations where local responsiveness outweighs consistency.
- ✗
Reduced need for executive oversight
Why it's wrong here
Centralised governance typically strengthens executive oversight through a single accountable authority, so it does not reduce that need. Reduced oversight would fit a federated model where business units self-govern, which is the correct choice when autonomy outweighs central control.
- ✓
Consistent enforcement of security policies and standards
Why this is correct
Centralised governance places policy ownership and enforcement authority with one body, so the same standards apply uniformly across every business unit. This directly satisfies the stem's requirement for a key benefit: eliminating the inconsistent, locally varied controls that fragmented, devolved governance models inevitably produce across an organisation.
- ✗
Faster adaptation to local business needs
Why it's wrong here
Centralised governance standardises controls across the enterprise, so local adaptation is slower by design; responsiveness belongs to decentralised or federated structures. It tempts because federated models genuinely let business units tailor controls to regional regulation or market conditions, which is the right choice when local agility outranks enterprise-wide consistency.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.