Isaca Updated CISM Exam Questions and Answers by maxim

The correct answer is D because a business case for an information security initiative should first be based on risk. Conducting a risk assessment identifies the threats, vulnerabilities, likelihood, business impact, regulatory exposure, control gaps, and potential consequences that justify the initiative. In a highly regulated environment, legal and compliance obligations are important inputs, but the business case should still be driven by risk to the organization, including compliance risk. Benchmarking against competitors may provide context, but it does not define the organization’s specific need. Consulting legal counsel may be necessary to interpret regulatory obligations, but it is not as complete as a risk assessment for developing a business case. A feasibility study is useful after the need and risk have been established. CISM emphasizes that security investments should be risk-based, business-aligned, and cost-justified. Therefore, the first step is to conduct a risk assessment to support the business case.

The biggest challenge is linking KRIs to specific risks to ensure that they accurately measure and signal potential exposures. If KRIs aren’t directly connected to real risks, they won’t effectively support risk management efforts.

“A key challenge in developing KRIs is ensuring that they are directly linked to specific risks to provide meaningful and actionable insights.”

— CISM Review Manual 15th Edition, Chapter 1: Information Security Governance, Section: Key Risk Indicators (KRIs)*

ISACA’s practice questions highlight the importance of clear linkage for effective risk measurement.

The correct answer is C because procedures describe specific operational steps for carrying out security requirements, and operational units are the groups that must execute those steps in practice. Procedures must be realistic, workable, and aligned with day-to-day business and technical processes. Involving operational units helps ensure that procedures reflect actual workflows, system dependencies, resource constraints, and control responsibilities. Audit management may review procedures for compliance or control adequacy, but auditors should not be the primary developers of operational procedures. Senior management approves direction and policy, but it usually does not define detailed procedural steps. End users may provide useful feedback for procedures affecting them, but operational units have the strongest understanding of how processes are performed and controlled. In CISM, effective security program management requires translating policies and standards into practical procedures that can be implemented consistently. Therefore, operational units are the most important group to involve in procedure development.

Security policy provisions are the statements or rules that define the information security objectives, principles, roles and responsibilities, and requirements for the organization. Security policy provisions must be established to maintain an effective information security governance framework, as they provide the foundation and direction for the information security activities and processes within the organization. Security policy provisions also help to align the information security governance framework with the business strategy and objectives, and ensure compliance with relevant laws and regulations. The other options, such as security controls automation, defined security metrics, or change management processes, are important components of an information security governance framework, but they are not essential to establish it. References:

https://www.iso.org/standard/74046.html

https://www.nistf.gov/cyberframework

https://www.iso.org/standard/27001