CISM Information Security Programme Practice Question
Which security control framework is organized into Implementation Groups (IG1, IG2, IG3) based on organizational risk profile and resources?
⚠ Common exam trap
CISM often tests familiarity with various frameworks; candidates may confuse CIS Controls with NIST or ISO, but the key differentiator is the Implementation Groups (IG1-IG3) unique to CIS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CIS Controls v8
The CIS Controls v8 (Center for Internet Security Critical Security Controls) are organized into Implementation Groups (IG1, IG2, IG3) that are tailored to organizations based on their risk profile and resources. IG1 is for small organizations with limited resources, IG2 for medium, and IG3 for large organizations with mature security programs. This structure is unique to CIS Controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NIST SP 800-53
Why it's wrong here
NIST SP 800-53 organises controls into baselines (Low, Moderate, High) tied to FIPS 199 impact ratings, not Implementation Groups. It is tempting because it is a comprehensive control catalogue widely mandated for US federal systems, where selecting a baseline by impact level is the correct approach.
- ✗
COBIT 2019
Why it's wrong here
COBIT 2019 structures governance around governance and management objectives across five domains, with design factors for tailoring; it defines no Implementation Groups. It is tempting because it also tailors guidance to organisational context, which suits enterprise IT governance and assurance roles rather than prescriptive control selection.
- ✗
ISO 27001 Annex A
Why it's wrong here
ISO 27001 Annex A lists 93 controls in four themes (organisational, people, physical, technological) with no Implementation Groups. It is tempting because Annex A controls are selected through risk assessment, so tailoring by risk profile applies — but the grouping mechanism is thematic, not IG1/IG2/IG3.
- ✓
CIS Controls v8
Why this is correct
CIS Controls v8 uniquely structures its safeguards into Implementation Groups IG1, IG2 and IG3, mapped to organisational risk profile and available resources. No other framework uses this tiered grouping, directly satisfying the stem's stated constraint.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.