hardMultiple SelectObjective-mapped
CISM Practice Question: Which THREE of the following are key indicators…
Which THREE of the following are key indicators of a mature information security governance process? (Select exactly three.)
⚠ Common exam trap
A common mix-up: candidates confuse operational effectiveness (e.g., fast patching or incident reduction) with governance maturity, which requires strategic alignment, board-level reporting, and defined risk appetite—not just tactical improvements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security risk appetite is defined and reported to the board
Defining and reporting security risk appetite to the board is a foundational governance activity that ensures executive oversight and alignment of risk tolerance with business strategy. In a mature governance process, the board must formally approve and periodically review the risk appetite statement, which directly influences resource allocation and control prioritization. This aligns with the ISACA CISM framework, which emphasizes that governance requires board-level engagement with risk appetite as a key performance indicator.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Security risk appetite is defined and reported to the board
Why this is correct
Key governance element.
- ✗
Mean time to patch critical vulnerabilities is under 48 hours
Why it's wrong here
Operational metric.
- ✓
Security performance metrics are linked to business outcomes
Why this is correct
Shows alignment of governance.
- ✓
Security strategy is reviewed and updated annually based on business changes
Why this is correct
Shows continuous governance improvement.
- ✗
Number of security incidents decreased by 20% year-over-year
Why it's wrong here
Outcome metric, not a governance process indicator.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.