CISSP Security and Risk Management Practice Question
A security auditor is reviewing an organization's governance framework. Which TWO of the following are commonly used frameworks for IT governance and security management?
⚠ Common exam trap
CISSP often tests whether candidates can distinguish governance/security frameworks (ISO 27001, COBIT, NIST) from adjacent disciplines like project management (PMBOK), enterprise architecture (TOGAF), and process improvement (Six Sigma).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ISO/IEC 27001
ISO/IEC 27001 (A) is correct because it is the internationally recognized standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS), directly addressing security management and governance controls. COBIT 2019 (D) is correct because it is ISACA's governance framework specifically designed for enterprise IT governance and management, providing control objectives and processes that align IT with business goals. PMBOK (B) is a project management body of knowledge focused on managing projects, not on IT governance or security management. TOGAF (C) is an enterprise architecture framework for designing and structuring IT architecture, not a governance or security management framework. Six Sigma (E) is a process improvement and quality management methodology aimed at reducing defects, not an IT governance or security framework.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ISO/IEC 27001
Why this is correct
ISO/IEC 27001 is a globally recognized standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides security auditors with a structured, risk-based framework to evaluate an organization's overall security governance, risk management, and control objectives.
- ✗
PMBOK
Why it's wrong here
The Project Management Body of Knowledge (PMBOK) is a specialized framework focused on project management lifecycles, execution, and methodologies. While it helps manage security-related projects, it does not provide the comprehensive organizational governance, risk management, or compliance structures required for evaluating enterprise security governance.
- ✗
TOGAF
Why it's wrong here
The Open Group Architecture Framework (TOGAF) is designed specifically for designing, planning, implementing, and governing enterprise information technology architecture. It lacks the dedicated risk management controls and compliance-driven security governance assessments found in dedicated security frameworks like ISO/IEC 27001.
- ✓
COBIT 2019
Why this is correct
COBIT 2019 is a comprehensive framework specifically designed for the governance and management of enterprise IT. It aligns business goals with IT practices, providing auditors with clear metrics, maturity models, and control objectives to evaluate how effectively IT governance supports the organization's strategic objectives.
- ✗
Six Sigma
Why it's wrong here
Six Sigma is a data-driven quality management methodology aimed at improving process outputs by identifying and removing the causes of defects and minimizing variability. It is not an IT governance or information security framework, making it unsuitable for auditing an organization's security governance posture.
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Information security management
Information security management is the systematic process of developing, implementing, monitoring, and improving policies, procedures, and controls to protect an organization's information assets from threats and ensure confidentiality, integrity, and availability.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.