Information Governance Frameworks and Standards CISM Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is adopting a new governance framework. The CISO must decide between implementing ISO/IEC 27001 or the NIST Cybersecurity Framework (CSF). The company has a mature risk management process and wants to avoid duplicating efforts. Which approach best leverages the existing risk management process?

   • AImplement ISO/IEC 27001 and replace the existing risk management process
   • BImplement the NIST CSF and align its risk management practices with the existing process
   • CChoose COBIT instead, as it is the only framework that integrates with risk management
   • DImplement both frameworks in parallel without integration
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following best describes the role of NIST frameworks and standards in information security governance?

   • AThey are legally binding regulations that all organizations must follow.
   • BThey provide a common language and a set of best practices for managing cybersecurity risk.
   • CThey focus exclusively on physical security controls.
   • DThey are only applicable to U.S. federal agencies.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When selecting a governance framework for an organization, which of the following should be the primary consideration?

   • AAlignment with the organization's strategic objectives and regulatory obligations.
   • BThe framework's cost, without considering its benefits.
   • CThe framework's popularity among other organizations in the same industry.
   • DThe framework's complexity, regardless of organizational needs.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A large enterprise is implementing a new information governance framework. The board of directors is concerned about the cost and effort of the implementation and wants to ensure that the framework delivers measurable value. The CISO must align the framework with the enterprise's strategic objectives. Which approach best ensures that the framework delivers value and aligns with enterprise governance?

   • AConduct a gap analysis against the framework and prioritize implementation based on business risk and strategic impact
   • BDelegate all implementation decisions to the IT department to reduce board involvement
   • COutsource the entire implementation to a consulting firm to minimize internal effort
   • DImplement the framework in its entirety as quickly as possible to achieve compliance
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a typical component of an information governance framework?

   • AA mandatory requirement that all data be stored on-premises.
   • BA specific brand of database software used for storing all corporate data.
   • CA list of every employee's personal device serial numbers.
   • DA set of roles, responsibilities, and decision rights for information management.
   Reveal Solution Discussion Select an answer first