CISM Information Security Program Practice Question
You are the director of information security at a multinational corporation that operates in many countries with conflicting data privacy laws. The company's information security program includes a data classification policy and a data retention schedule, but there is no consistent method for handling cross-border data flows. Recently, a regulator in Country A fined the company for transferring personal data to Country B, which does not provide adequate protection. The legal department recommends implementing a binding corporate rules (BCR) approach, but the IT department says it would be too complex to implement across all systems. You must update the program to ensure compliance while minimizing operational impact. The board wants a solution that can be implemented within one year with reasonable cost. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct a data mapping exercise and implement a data classification tagging system to automate controls on sensitive data flows.
Correct answer is C because a data mapping exercise with automated tagging provides the foundation to enforce controls without manual effort. This approach allows the company to understand where sensitive data flows, apply appropriate protections (such as BCR or SCCs) only where needed, and minimize operational impact. Option A (implement BCR globally) is complex and time-consuming. Option B (rely on standard contractual clauses for all flows) may not be sufficient for all jurisdictions and is administrative heavy. Option D (stop all cross-border transfers) is impractical and would harm business operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement binding corporate rules (BCR) across all entities as recommended by legal.
Why it's wrong here
BCR implementation is complex, time-consuming, and may not be feasible in one year.
- ✗
Rely on standard contractual clauses (SCCs) for all cross-border data flows.
Why it's wrong here
SCCs are administrative and may not address technical controls; still requires implementation.
- ✓
Conduct a data mapping exercise and implement a data classification tagging system to automate controls on sensitive data flows.
Why this is correct
Provides visibility and enables automated enforcement, scalable within one year.
- ✗
Stop all cross-border data transfers until compliant mechanisms are fully implemented.
Why it's wrong here
Would severely impact business operations.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.