Information Governance Frameworks and Standards CISM Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A government contractor must comply with NIST SP 800-171 for protecting controlled unclassified information (CUI). The company also wants to adopt a broader governance framework to manage its overall security program. Which combination of standards would best meet both requirements?

   • AAdopt ISO/IEC 27001 as the overarching ISMS and map NIST SP 800-171 controls to it
   • BUse CIS Controls as the primary framework and treat NIST SP 800-171 as optional
   • CImplement COBIT for IT governance and ignore NIST SP 800-171
   • DUse NIST SP 800-171 as the sole framework for all security governance
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is adopting a governance framework and wants to ensure that it can measure the effectiveness of its security program. The CISO wants to use a framework that includes maturity models and capability levels. Which framework best supports this need?

   • ACOBIT
   • BISO/IEC 27001
   • CCIS Controls
   • DNIST SP 800-53
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A multinational corporation is adopting a new information security framework. The CISO must choose between ISO/IEC 27001 and NIST Cybersecurity Framework (CSF). The company operates in a highly regulated industry and needs to demonstrate compliance to multiple regulators. Which factor should most influence the decision?

   • AISO/IEC 27001 provides a certifiable ISMS that can be audited by third parties
   • BThe NIST CSF is free and easier to implement
   • CISO/IEC 27001 is more aligned with IT service management
   • DThe NIST CSF is more widely used in the private sector
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How does an information governance framework typically integrate with enterprise risk management (ERM)?

   • ABy aligning information security risk management with the organization's overall risk appetite and reporting structures.
   • BBy transferring all information security risks to external insurers.
   • CBy eliminating the need for a separate enterprise risk management function.
   • DBy isolating information security risks from other enterprise risks to avoid interference.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is implementing an information governance framework and wants to ensure that it addresses the full lifecycle of information, from creation to disposal. Which component of the framework is most relevant to this requirement?

   • AAccess control policies
   • BInformation lifecycle management policies
   • CData classification and handling procedures
   • DIncident response procedures
   Reveal Solution Discussion Select an answer first