ISACA CISM Exam Questions
Certified Information Security Manager (Page 47 )

Updated On: 19-Feb-2026

Which of the following should be established FIRST when implementing an information security governance framework?

  1. Security incident management team
  2. Security awareness training program
  3. Security architecture
  4. Security policies

Answer(s): D



Which is MOST important to identify when developing an effective information security strategy?

  1. Business assets to be secured
  2. Potential savings resulting from security governance
  3. Compliance requirements
  4. Control gaps that require remediation

Answer(s): A



Which of the following is MOST important to consider when determining the effectiveness of the information security governance program?

  1. Key performance indicators (KPIs)
  2. Key risk indicators (KRIs)
  3. Maturity models
  4. Risk tolerance levels

Answer(s): A



The PRIMARY purpose of establishing an information security governance framework should be to:

  1. align information security strategy and investments to support organizational activities
  2. align corporate governance, activities, and investments to information security goals
  3. establish the business case for strategic integration of information security in organizational efforts
  4. document and communicate how the information security program functions within the organization

Answer(s): A



Which of the following is MOST important to have in place to help ensure an organization's cybersecurity program meets the needs of the business?

  1. Information security awareness training
  2. Information security metrics
  3. Risk assessment program
  4. Information security governance

Answer(s): D






Post your Comments and Discuss ISACA CISM exam dumps with other Community members:

Join the CISM Discussion