How does the organization's risk appetite MOST directly influence its information security strategy?

It sets the residual risk level the strategy targets, guiding how much investment is justified

While developing the security strategy, the information security manager identifies that the corporate culture strongly resists centralized controls. How should this factor be handled?

Treat it as a constraint, designing the strategy and its rollout to work within the culture or to change it

The security team publicly names employees who fail phishing simulations. What is the MOST likely effect on security culture?

Employees become reluctant to report mistakes and suspicious activity

What is the BEST way to ensure security responsibilities are understood across the organization?

Documenting roles and responsibilities in a RACI matrix and communicating them

A new data protection regulation will apply to the organization in six months. What should the information security manager do FIRST?

Perform a gap analysis between current practices and the regulation's requirements

The information security manager reports to the CIO, who also owns the IT delivery budget and schedules. Security concerns about IT projects are often deprioritized. What is the BEST governance response?

Propose a reporting line or escalation path giving security independent access to leadership

A culture survey shows that many employees do not know how to report a suspected security incident. What is the BEST response?

Make reporting simple and well publicized, reinforced through managers and training

A gap analysis for the new security strategy identifies many gaps, but the budget can address only some of them this year. How should the gaps be prioritized?

By the risk each gap poses to critical business objectives and the assets those objectives depend on

Free CISM Domain 1 Practice Questions with Answers

2026-10-19

These five CISM Domain 1 questions are drawn from Auditor Path's bank. Each follows ISACA's item-writing style: a scenario, four plausible options and one BEST answer. Read the explanation even when you get it right — it names the judgment the exam is testing.

Domain 1, Information Security Governance, is 17% (18% from 3 November 2026) of the CISM exam.

Question 1: Organizational Culture

An information security manager has run a culture improvement program for a year and must report its effect to senior management. Which measure is MOST meaningful?

A. The number of security policies approved during the year
B. Change in behaviors such as reporting and exception rates versus a pre-program baseline
C. The percentage of staff who completed the annual awareness course and passed its final quiz
D. The number of awareness posters, emails and intranet messages issued during the year

Answer: B. Culture is reflected in what people actually do. Comparing behavioral indicators with a pre-program baseline shows whether the program achieved real change.

Exam mindset: Measure outcomes, not activity.

Question 2: Information Governance Frameworks and Standards

The security team selected control baselines for a new framework, but the board has never defined how much information risk the organization is willing to take. What is the MOST significant consequence?

A. Incident response procedures will be unable to function without a defined escalation threshold
B. Security staff will need additional technical training to select and calibrate the baselines
C. Control strength cannot be aligned with business expectations, risking over- or under-protection
D. The framework cannot be certified by an external body until a risk appetite statement is issued

Answer: C. Risk appetite sets the boundaries for acceptable risk. Without it, control decisions lack a business reference point, leading to misallocated effort and inconsistent risk decisions.

Exam mindset: Appetite first, controls second.

Question 3: Legal, Regulatory and Contractual Requirements

The information security manager learns that a key supplier has started using a subcontractor to process the organization's regulated data, without informing the organization. What should the information security manager do FIRST?

A. Terminate the supplier contract immediately for breach of its notification duties
B. Ask the subcontractor to sign a confidentiality agreement directly with the organization
C. Schedule an onsite audit of the subcontractor's facilities
D. Review the subcontracting terms and assess the impact on meeting its obligations

Answer: D. The organization remains accountable for regulated data across the supply chain. Establishing what the contract allows and the compliance impact is the necessary first step before choosing a response.

Exam mindset: Know the contract before acting on it.

Question 4: Strategic Planning (e.g., Budgets, Resources, Business Case)

The security strategy was approved two years ago, and the organization has since shifted to a digital-first business model. What should the information security manager do?

A. Review and update the security strategy so that it aligns with the revised digital-first business strategy
B. Add digital controls to the existing roadmap without revisiting the approved priorities
C. Wait for an audit finding on the strategy before changing its direction or priorities
D. Continue executing the approved strategy to maintain consistency until its planned end date

Answer: A. Security strategy must follow business strategy. A major change in the business model requires revisiting objectives, priorities and resources.

Exam mindset: When the business changes, the strategy changes.

Question 5: Information Security Strategy Development

The organization is negotiating to acquire another company. When should the information security manager be involved?

A. During due diligence, to assess the target's security posture, incidents and obligations before closing
B. After closing, during the integration planning phase when systems are combined
C. Only if the target has disclosed a significant security breach during negotiations
D. Only when the finance team requests a review of IT asset values for the purchase price

Answer: A. Security findings in due diligence can change price, terms or integration plans, and reveal inherited liabilities.

Exam mindset: Assess risk before you inherit it.

Keep practising

The quiz below draws more questions from every CISM Domain 1 subtopic. Sign in to practise the full bank, take timed 150-question mocks and see your readiness by domain.