Information Governance Frameworks and Standards CISM Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A healthcare organization is adopting a new information governance framework. The board of directors wants to ensure that the framework aligns with the organization's overall enterprise risk management approach and that security decisions are made at the appropriate level. Which action best demonstrates integration of the information governance framework with enterprise governance?

   • AAssigning the CISO sole responsibility for framework implementation and reporting
   • BEstablishing a steering committee with representation from executive leadership, legal, and IT to oversee framework implementation
   • CPublishing the framework on the intranet for all employees to review
   • DConducting a single risk assessment at the start of the project
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A global technology company operates in multiple jurisdictions with conflicting data protection regulations. The company has adopted ISO/IEC 27001 for its ISMS but is struggling to align its security controls with the varying legal requirements. The CISO must decide how to adapt the framework to address these conflicts. Which approach is most effective?

   • AImplement a core set of controls based on ISO/IEC 27001 and supplement with region-specific controls to address local legal requirements
   • BAbandon ISO/IEC 27001 and develop a custom framework from scratch
   • CMaintain a single global policy that meets the lowest common denominator of all regulations
   • DAdopt the most stringent regulatory requirement as the baseline for all global operations
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following best describes the primary purpose of an information governance framework?

   • ATo provide a structured approach for aligning information management practices with organizational objectives and compliance requirements.
   • BTo guarantee that all information assets are stored in a single centralized repository.
   • CTo replace the need for technical security controls by focusing solely on policy documentation.
   • DTo ensure that only the IT department is responsible for information security decisions.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company's board of directors wants to ensure that information security risks are considered in the organization's overall risk management decisions. The CISO is asked to integrate the information governance framework with the enterprise risk management (ERM) process. Which action would most effectively achieve this integration?

   • AIncluding information security risk in the enterprise risk register
   • BReporting security incidents only to the CISO
   • CConducting security risk assessments independently of the ERM cycle
   • DCreating a separate risk register for information security only
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why might an organization adapt a governance framework rather than adopt it as-is?

   • ATo simplify the framework by removing all security controls.
   • BTo tailor the framework to the organization's specific size, industry, and risk appetite.
   • CTo make the framework easier to audit by ignoring regulatory requirements.
   • DTo ensure the framework is identical to competitors' frameworks.
   Reveal Solution Discussion Select an answer first