CISM Information Security Governance Practice Question
Which of the following is the PRIMARY responsibility of the board of directors regarding information security governance?
⚠ Common exam trap
The trap is that operational-sounding options (vulnerability assessments, tool approval, monitoring) feel security-relevant, so candidates pick them; CISM consistently tests that the board's role is strategic direction and oversight, never hands-on execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Setting the strategic direction and oversight of the security programme
The board of directors is responsible for governance, not operations. Its primary security governance duty is to set the strategic direction for the security programme and provide oversight to ensure it aligns with business objectives and risk appetite. Technical execution is delegated to management and security staff.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Performing technical vulnerability assessments
Why it's wrong here
Vulnerability assessment is hands-on technical work performed by security engineers or analysts, sitting far below governance. The board's role is directing and overseeing the security programme, not executing scans. Technical testing would be the right answer if the question asked who performs operational security assessments.
- ✗
Approving specific security tools and technologies
Why it's wrong here
Tool selection is a management execution task delegated to security leadership, not board-level governance. The board sets risk appetite and strategy, then receives assurance. Approving specific products would be the correct action for a CISO or security steering committee, not directors.
- ✗
Conducting daily security monitoring activities
Why it's wrong here
Daily monitoring is an operational control executed by the security operations centre, not a governance function. The board provides oversight and strategic direction instead. Monitoring would be correct if the question asked which activity belongs to SOC analysts or security administrators.
- ✓
Setting the strategic direction and oversight of the security programme
Why this is correct
The board owns governance, not implementation. Setting strategic direction and overseeing the security programme aligns security with business objectives and risk appetite, which is the board's primary governance duty rather than operational or technical decisions.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.