Information Security Governance — CISM Practice Questions

A critical security service is outsourced and executives assume accountability has moved to the provider. Which governance position is MOST appropriate?

• A.The organisation retains accountability while the provider performs contracted activities
• B.The provider assumes full accountability for the outsourced service
• C.The internal audit function becomes accountable for the outsourced activity
• D.The procurement department accepts the cyber‑risk associated with the outsourcing

Why: Outsourcing transfers the performance of a security function, not the ownership of its results. Governance frameworks require the organization to retain accountability for security while the provider fulfills the contracted tasks, ensuring proper oversight and compliance. The organization must keep ultimate accountability for security outcomes even when execution is delegated to a provider.

A proposed security strategy lists specific products but fails to explain how security supports the organization’s goals. What should be improved FIRST?

• A.Identify and prioritize individual security tools based on vendor features and cost
• B.Develop a compliance checklist that enumerates required controls for each regulatory framework
• C.Replace the existing security products with newer solutions that have higher market ratings
• D.Map security outcomes and initiatives to business objectives and material risks

Why: A security strategy must be driven by the organization’s mission, objectives, and risk profile. By mapping security initiatives to business goals and material risks, the strategy becomes a business enabler rather than a disconnected technology list. This alignment guides investment decisions and prioritizes actions that deliver real value. Aligning security outcomes with business objectives and material risks ensures the strategy directly supports enterprise goals.

A new regulation imposes incident reporting duties, but business units disagree on who must notify the regulator. What is the BEST governance action?

• A.Allow the SOC to decide on notification for each incident, then document the outcome.
• B.Wait until a reportable incident occurs before establishing any notification procedures.
• C.Define decision rights, assign accountability, and establish escalation paths, then communicate them.
• D.Assign all regulator notifications to internal audit and have them handle reporting exclusively.

Why: Effective governance requires decision rights, accountability, and escalation paths to be defined and communicated in advance so reporting obligations are met consistently. Without these structures, organizations risk fragmented responses, regulatory breaches, and loss of control over incident handling. It creates clear authority and responsibility for reporting before incidents occur, ensuring consistent compliance.

A transformation initiative introduces cloud services and APIs, but the organization’s security architecture has not been updated. What should the CISO recommend as the first step?

• A.Retain the existing security architecture until a security incident occurs
• B.Purchase a single enterprise security product to protect the new services
• C.Align security architecture with the target enterprise architecture and roadmap
• D.Delegate all security architecture responsibilities to the cloud service providers

Why: Security architecture should evolve in step with business and technology changes. Aligning it with the target enterprise architecture and roadmap ensures that security controls are integrated, consistent, and support the organization’s strategic objectives, especially when adopting cloud services and APIs. Because security architecture must be synchronized with the evolving enterprise architecture to ensure controls are effective across cloud services and APIs.

The board asks how much cyber risk the organization is willing to accept; what should inform the answer?

• A.The CISO’s personal comfort level with cyber threats and controls
• B.The organization’s approved risk appetite and tolerance defined through governance
• C.The vendor’s recommended security settings and configurations for the organization
• D.The average vulnerability count reported across comparable organizations in the sector

Why: Enterprise risk appetite and tolerance are set by governance bodies to align risk acceptance with strategic objectives and regulatory requirements. Management uses these approved parameters, not personal opinions, vendor suggestions, or industry averages, to answer board inquiries about acceptable cyber risk. Risk appetite and tolerance are governance decisions that establish the level of risk the enterprise is prepared to accept.

A business unit routinely bypasses security review to meet sales deadlines, and its leaders reward this behavior. What is MOST likely to improve the security culture?

• A.Issue another policy without leadership involvement or support
• B.Have leaders reinforce expected behaviours and hold owners accountable
• C.Increase annual attestations only for the business unit
• D.Transfer all security-related decisions to the security function

Why: Security culture is shaped by leadership actions, incentives, and accountability. Changing policies or processes without addressing leadership behavior typically yields limited impact. Effective cultural change requires leaders to model and enforce security‑aligned behaviours. Leadership sets the tone; by reinforcing desired behaviours and holding owners accountable, the organization aligns incentives with security objectives.

An acquisition introduces differing security architectures, policies, and risk tolerances. What should the CISO do first?

• A.Assess the business, technology, regulatory and risk differences before integration.
• B.Standardize all security products and controls across both companies immediately.
• C.Suspend the integration effort until senior management approves a new security roadmap.
• D.Adopt the acquired entity’s security policies unchanged and apply them organization‑wide.

Why: Before merging security environments, the CISO must evaluate the distinct business objectives, technological stacks, regulatory obligations, and risk appetites of both entities. This assessment identifies gaps, overlaps, and compliance issues, enabling a tailored integration strategy that balances security effectiveness with business goals. Skipping this step can lead to misaligned controls, increased risk, and regulatory non‑compliance. A fact‑based assessment of business, technology, regulatory and risk differences provides the necessary context to develop a safe, compliant integration plan.

The board receives hundreds of technical alerts but cannot tell whether enterprise risk is changing. What should the CISO change?

• A.Provide raw technical alerts to the board without contextualizing them for business impact
• B.Translate the alerts into business‑relevant risk trends, exceptions, and decisions
• C.Stop reporting security alerts until perfect metrics are available and validated
• D.Report only blocked attacks, ignoring other indicators that could affect the risk profile

Why: Effective governance reporting must translate security metrics into business‑relevant risk information that executives can use for decisions. Providing raw alerts or overly narrow data fails to give the board a clear view of the organization’s risk posture. The CISO should therefore present synthesized risk trends, exceptions, and actionable decisions aligned with enterprise objectives. It converts technical data into information that supports board oversight and risk‑based decision making.

A cloud provider proposes unrestricted subcontracting without notice; what should be assessed FIRST?

• A.Provider's brand reputation, market perception and advertising claims
• B.Immediate contract termination without continuity or transition planning
• C.Contractual, regulatory, data-location and fourth-party implications
• D.Technical specifications, service level agreements and performance metrics

Why: Unrestricted subcontracting introduces external dependencies that can affect compliance, data residency, and contractual obligations. Governance requires a first‑step analysis of contractual terms, regulatory requirements, data‑location constraints, and fourth‑party risks before proceeding. It addresses the legal, regulatory, data‑location and fourth‑party risk aspects that must be understood before any subcontracting arrangement is accepted.

Executives assert that adopting a recognized security framework guarantees the organization’s security. What is the BEST response?

• A.A framework automatically ensures all controls are effective across the organization.
• B.A framework eliminates the need for ongoing risk assessments and monitoring.
• C.A framework provides structure; effectiveness requires tailored implementation and evidence.
• D.A framework is primarily the technical team's responsibility, not senior management.

Why: Frameworks such as ISO/IEC 27001, NIST CSF, or COBIT provide a common structure and control objectives, but they do not deliver security by themselves. Organizations must adapt the controls to their risk profile, implement them, and collect evidence of their operation, with senior management overseeing the process. It accurately reflects that a framework offers a baseline, but security depends on customized implementation and documented evidence.

An international manufacturing firm has recently expanded its product lines and wants its information security program to reflect the company’s purpose and the diverse cultures of its global workforce. What should the information security manager do first to ensure the security program aligns with the organization’s purpose and culture?

• A.Prepare a detailed budget proposal for new security tools and services.
• B.Develop a comprehensive technical security policy based on industry best‑practice standards.
• C.Assign explicit security responsibilities to each department head in the org chart.
• D.Conduct a cultural assessment to identify employee attitudes and beliefs about security.

Why: Begin security governance by understanding the organization’s mission and cultural context before designing controls. NIST SP 800-12r1 notes that information security is constrained by societal and cultural factors, and NIST SP 800-100 emphasizes that governance must align security strategies with the organization’s mission. A cultural assessment directly addresses these requirements, providing the foundation for a purpose‑driven security program.

A newly enacted privacy law expands the definition of personal data, affecting the organization’s existing data‑handling policies. Which initial action should the information security manager take?

• A.Conduct a gap analysis to compare current policies against the new law
• B.Revise the data‑classification scheme to include the new data types
• C.Implement multi‑factor authentication for all user accounts
• D.Engage external legal counsel to draft a compliance roadmap

Why: Identify the first step for adapting to changed legal requirements A gap analysis directly identifies where existing policies fall short of the new legal definition, aligning with NIST SP 800‑100’s focus on maintaining currency with evolving legislation.