easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A small business wants to implement a security…
A small business wants to implement a security policy that balances protection with usability. Which of the following is the MOST important factor when developing the policy?
⚠ Common exam trap
Many candidates confuse 'enforceability' (Option C) with policy effectiveness, but the CISSP emphasizes that policy must first be business-aligned; technical enforcement is a later step in the governance hierarchy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Aligning the policy with business objectives and risk appetite.
A security policy must be aligned with the organization's business objectives and risk appetite to ensure it supports operations without imposing unnecessary restrictions. For a small business, this balance is critical—overly strict controls can hinder productivity, while weak controls increase risk. The policy should reflect the specific threats and tolerances of the business, not generic templates or compliance-only checklists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Adopting a template from a similar organization to save time.
Why it's wrong here
While templates can offer a starting point, simply adopting one from another organization is problematic because it fails to account for the unique operational context, specific asset criticality, organizational culture, and precise risk appetite of the small business. Such a policy may contain irrelevant clauses, omit critical controls for specific threats, or be unenforceable due to a mismatch with internal processes, ultimately failing to provide tailored and effective security.
- ✓
Aligning the policy with business objectives and risk appetite.
Why this is correct
This is the most crucial initial step because a security policy must fundamentally support the organization's mission and strategic goals. By aligning with business objectives, the policy ensures security measures facilitate, rather than hinder, operations. Incorporating the organization's risk appetite ensures that security investments and controls are proportionate to the acceptable level of residual risk, optimizing resource allocation and providing relevant protection.
- ✗
Ensuring the policy is enforceable with technical controls.
Why it's wrong here
Enforceability is undoubtedly a vital characteristic of an effective security policy; however, it is a secondary consideration to defining *what* the policy aims to achieve. A policy must first articulate the security requirements based on business needs and risk assessments. Only after these requirements are established can appropriate technical and administrative controls be selected and implemented to ensure the policy's mandates can be effectively and consistently enforced.
- ✗
Basing the policy solely on regulatory compliance requirements.
Why it's wrong here
While regulatory compliance is a mandatory aspect of security and often a significant driver for policy development, basing a policy *solely* on these requirements is insufficient for comprehensive risk management. Compliance typically represents a minimum baseline and may not address all unique organizational risks, specific threat landscapes, or industry best practices that extend beyond legal mandates, potentially leaving critical security gaps unaddressed.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.