Business objectives before technology

Exam

CISA & CISM

What it means

The exam rewards answers that start from business goals, business impact and risk, not from tools. If one option buys a product and another understands the business need first, pick the second.

The trap answer looks like

Buy a tool, deploy a technology, or apply the strictest technical control.

The winning answer looks like

Understand the business objective, process or impact first, then choose controls that support it.

Worked example

A new security manager finds that staff see security as an obstacle. What first?

❌ Enforce stricter controls
✅ Understand the business processes and stakeholders' concerns

You cannot align security with work you do not understand.