CISM Exam 2026: Certified Information Security Manager Practice
Test — Information Security Governance, Risk Management,
Security Programs & Incident Management — 190 Multiple-Choice
Questions with Answers & Detailed Rationales
Question 1
An organization's board of directors has asked the CISO to provide a single, high-level metric
that best demonstrates the effectiveness of the information security program. Which of the
following is the MOST appropriate metric to present?
A. The number of security incidents detected last quarter.
B. The percentage of critical business services with a tested disaster recovery plan.
C. The total number of malware infections blocked by antivirus software.
D. The percentage of employees who completed annual security awareness training.
Correct Answer: B
Explanation: This metric directly links the security program's resilience to the continuity of
critical business operations, a primary concern for a board of directors.
Question 2
A security manager is developing the information security strategy for a new cloud-first
startup. The primary goal is to enable rapid, secure growth. Which of the following should be
the MOST important consideration when aligning the security strategy with the business
strategy?
,A. Implementing the latest AI-driven security tools to demonstrate innovation.
B. Ensuring the security strategy is flexible and can scale with the business.
C. Adopting a rigid, best-practice framework like ISO 27001 from day one.
D. Focusing solely on compliance with GDPR to avoid future fines.
Correct Answer: B
Explanation: For a startup focused on growth, the security strategy must be agile and
scalable, enabling the business rather than hindering it with overly rigid controls.
Question 3
A CISM is reviewing the organization's security governance structure. The CEO has ultimate
responsibility for the organization's operations but delegates security to the CISO. Who
should ultimately be accountable for the organization's information security?
A. The Chief Information Security Officer (CISO).
B. The Chief Information Officer (CIO).
C. The Board of Directors.
D. The Chief Executive Officer (CEO).
Correct Answer: C
Explanation: The Board of Directors holds ultimate fiduciary responsibility and accountability
for all aspects of the organization, including information security governance.
Question 4
,A multinational corporation is establishing a security governance framework. The CISO needs
to ensure that security decisions are aligned with business objectives and risk appetite.
Which of the following is the MOST effective mechanism for achieving this?
A. Creating a security steering committee composed of business unit leaders and the CISO.
B. Mandating that all security decisions are made by the CISO's office.
C. Outsourcing all security governance to a specialized consulting firm.
D. Delegating all security governance responsibilities to the IT department.
Correct Answer: A
Explanation: A steering committee with business representation ensures security strategy is
directly aligned with and supports business objectives and risk tolerance.
Question 5
An organization has recently experienced a data breach. The post-incident review reveals
that the security team's actions were technically sound, but they failed to keep executive
management informed. Which area of the security program MOST needs improvement?
A. Incident Response Plan (IRP) technical procedures.
B. Security governance and communication protocols.
C. Security awareness training for all employees.
D. Vulnerability management processes.
Correct Answer: B
Explanation: The failure was not technical but in communication and governance. Clear
protocols for escalating and reporting to executives are part of a mature governance
structure.
, Question 6
Which of the following is the PRIMARY objective of information security governance?
A. To eliminate all identified risks to the organization.
B. To ensure security investments are aligned with business goals and risk appetite.
C. To ensure compliance with all applicable laws and regulations.
D. To implement the most technically advanced security controls available.
Correct Answer: B
Explanation: Governance is the framework for aligning security activities with business
strategy, ensuring that security supports and enables the business's objectives.
Question 7
A new CISO has been hired to build a security program from the ground up. What should be
the FIRST step in developing the information security strategy?
A. Purchase and deploy a next-generation firewall.
B. Conduct a comprehensive risk assessment.
C. Understand the organization's business model and strategic objectives.
D. Hire a team of security analysts.
Correct Answer: C
Explanation: The security strategy must be derived from and support the business strategy.
Understanding the business is the foundational first step.
Test — Information Security Governance, Risk Management,
Security Programs & Incident Management — 190 Multiple-Choice
Questions with Answers & Detailed Rationales
Question 1
An organization's board of directors has asked the CISO to provide a single, high-level metric
that best demonstrates the effectiveness of the information security program. Which of the
following is the MOST appropriate metric to present?
A. The number of security incidents detected last quarter.
B. The percentage of critical business services with a tested disaster recovery plan.
C. The total number of malware infections blocked by antivirus software.
D. The percentage of employees who completed annual security awareness training.
Correct Answer: B
Explanation: This metric directly links the security program's resilience to the continuity of
critical business operations, a primary concern for a board of directors.
Question 2
A security manager is developing the information security strategy for a new cloud-first
startup. The primary goal is to enable rapid, secure growth. Which of the following should be
the MOST important consideration when aligning the security strategy with the business
strategy?
,A. Implementing the latest AI-driven security tools to demonstrate innovation.
B. Ensuring the security strategy is flexible and can scale with the business.
C. Adopting a rigid, best-practice framework like ISO 27001 from day one.
D. Focusing solely on compliance with GDPR to avoid future fines.
Correct Answer: B
Explanation: For a startup focused on growth, the security strategy must be agile and
scalable, enabling the business rather than hindering it with overly rigid controls.
Question 3
A CISM is reviewing the organization's security governance structure. The CEO has ultimate
responsibility for the organization's operations but delegates security to the CISO. Who
should ultimately be accountable for the organization's information security?
A. The Chief Information Security Officer (CISO).
B. The Chief Information Officer (CIO).
C. The Board of Directors.
D. The Chief Executive Officer (CEO).
Correct Answer: C
Explanation: The Board of Directors holds ultimate fiduciary responsibility and accountability
for all aspects of the organization, including information security governance.
Question 4
,A multinational corporation is establishing a security governance framework. The CISO needs
to ensure that security decisions are aligned with business objectives and risk appetite.
Which of the following is the MOST effective mechanism for achieving this?
A. Creating a security steering committee composed of business unit leaders and the CISO.
B. Mandating that all security decisions are made by the CISO's office.
C. Outsourcing all security governance to a specialized consulting firm.
D. Delegating all security governance responsibilities to the IT department.
Correct Answer: A
Explanation: A steering committee with business representation ensures security strategy is
directly aligned with and supports business objectives and risk tolerance.
Question 5
An organization has recently experienced a data breach. The post-incident review reveals
that the security team's actions were technically sound, but they failed to keep executive
management informed. Which area of the security program MOST needs improvement?
A. Incident Response Plan (IRP) technical procedures.
B. Security governance and communication protocols.
C. Security awareness training for all employees.
D. Vulnerability management processes.
Correct Answer: B
Explanation: The failure was not technical but in communication and governance. Clear
protocols for escalating and reporting to executives are part of a mature governance
structure.
, Question 6
Which of the following is the PRIMARY objective of information security governance?
A. To eliminate all identified risks to the organization.
B. To ensure security investments are aligned with business goals and risk appetite.
C. To ensure compliance with all applicable laws and regulations.
D. To implement the most technically advanced security controls available.
Correct Answer: B
Explanation: Governance is the framework for aligning security activities with business
strategy, ensuring that security supports and enables the business's objectives.
Question 7
A new CISO has been hired to build a security program from the ground up. What should be
the FIRST step in developing the information security strategy?
A. Purchase and deploy a next-generation firewall.
B. Conduct a comprehensive risk assessment.
C. Understand the organization's business model and strategic objectives.
D. Hire a team of security analysts.
Correct Answer: C
Explanation: The security strategy must be derived from and support the business strategy.
Understanding the business is the foundational first step.
