CISM Information Security Program Practice Question
You are the CISO of a retail company that is planning to implement a new e-commerce platform. The information security program currently consists of a set of high-level policies, but there are no detailed standards or guidelines for secure development. The development team uses agile methodologies and is accustomed to rapid releases. They have resisted security reviews in the past, citing delays. You need to integrate security into the development lifecycle without causing friction. The company's risk appetite is moderate; they accept some risk for speed but not if it leads to major breaches. The board expects you to manage this risk effectively. Which approach should you take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a security champion to each development team and create a lightweight secure coding checklist.
Assigning a security champion to each team and creating a lightweight secure coding checklist integrates security into the agile development process without causing significant friction. Security champions provide ongoing guidance and can help enforce secure coding practices in real-time, which aligns with the rapid release cycles. Option A (annual training) is insufficient to change behavior and does not provide continuous oversight. Option C (separate security team review after development) introduces delays and friction, as developers have already completed their work. Option D (mandatory security gate before release) can cause bottlenecks and resentment, likely being bypassed or causing slowdowns that the company wants to avoid.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Provide annual security training to all developers.
Why it's wrong here
Training alone does not ensure application of knowledge.
- ✓
Assign a security champion to each development team and create a lightweight secure coding checklist.
Why this is correct
Incorporates security into the process without heavy process overhead.
- ✗
Establish a separate security team that reviews all code after development is complete.
Why it's wrong here
Late-stage reviews are less effective and can cause rework and delays.
- ✗
Implement a mandatory security gate before each release, requiring a full security review.
Why it's wrong here
Will be perceived as a bottleneck and create resistance.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.