CISM Information Security Program Practice Question
Which of the following best describes the primary purpose of an information security program?
⚠ Common exam trap
A common trap in the CISM exam is the misconception that compliance equals security, leading candidates to choose Option D, but the CISM framework emphasizes that compliance is a baseline, not a comprehensive risk management strategy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To manage security risks in alignment with business strategy
The primary purpose of an information security program is to manage security risks in alignment with business strategy, ensuring that security controls and investments support organizational objectives while balancing risk acceptance, mitigation, transfer, and avoidance. This aligns with the CISM framework, which emphasizes that security is a business enabler, not a technical silo. A program that fails to align with business strategy may over-prioritize technical controls, leading to wasted resources or misaligned risk tolerance levels.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To ensure 100% system availability
Why it's wrong here
Availability is a subgoal; program balances confidentiality, integrity, and availability.
- ✗
To eliminate all security risks
Why it's wrong here
Risk cannot be eliminated; it is managed.
- ✓
To manage security risks in alignment with business strategy
Why this is correct
Program ensures security supports business objectives.
- ✗
To achieve compliance with all applicable regulations
Why it's wrong here
Compliance is part, but program also addresses business risks.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.