hardMultiple ChoiceObjective-mapped
CISSP Practice Question: A multinational corporation is establishing a…
A multinational corporation is establishing a security governance framework. The board of directors wants to ensure that information security strategy aligns with business objectives. Which role is primarily responsible for integrating security into the organization's strategic decision-making?
⚠ Common exam trap
Many exam-takers confuse operational responsibility (IT security team) with strategic accountability (senior management), leading them to select the IT security team because they are the ones executing security tasks, but the CISSP emphasizes that governance and strategic alignment are board-level duties.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Senior management
Senior management (C) is primarily responsible for integrating security into strategic decision-making because they hold the authority to allocate resources, define risk appetite, and ensure that security initiatives directly support business objectives. In a governance framework, only senior management can bridge the gap between operational security and enterprise strategy, as they are accountable for the organization's overall risk posture and compliance mandates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IT security team
Why it's wrong here
The IT security team is primarily responsible for the tactical implementation, operation, and maintenance of security controls and processes within an established framework. While crucial for executing security policies and responding to incidents, their role is operational and technical, not to define the strategic security governance structure or set enterprise-wide risk appetite. Establishing security governance requires a broader organizational perspective and executive authority.
- ✗
Internal audit team
Why it's wrong here
The internal audit team's primary function is to provide independent and objective assurance regarding the effectiveness of risk management, control, and governance processes. They evaluate compliance with established policies and procedures, identify control weaknesses, and recommend improvements. However, their role is evaluative and advisory, not to define or establish the initial strategic security governance framework or set the organization's security objectives.
- ✓
Senior management
Why this is correct
Senior management is ultimately responsible for establishing and overseeing the organization's security governance framework. They possess the necessary authority to define the strategic direction for security, articulate the enterprise's risk appetite, and ensure that security objectives are fully integrated with and support overall business goals. This leadership ensures adequate resources are allocated and accountability is clearly defined across the organization.
- ✗
Data owner
Why it's wrong here
A data owner is responsible for specific datasets, determining their classification, criticality, and access requirements based on business needs and regulatory mandates. While vital for data-level security decisions and ensuring data protection, their scope is limited to their assigned information assets. They do not possess the enterprise-wide authority or strategic perspective required to establish the overarching security governance framework for the entire multinational corporation.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.