Certified Information Security Manager (CISM)

Last checked October 22, 2026 against the official ISACA exam page.

1. Question 1Information Security Program

   Which element is the foundation of an information security program that can be measured and improved over time?

   1. AA set of security tools, purchased and deployed across all systems at the start of the program
   2. BA large security team, whose size is the main indicator of how mature the program is
   3. CA documented security architecture, with controls mapped to requirements and reviewed regularly
   4. DA yearly awareness event, held in the largest office of the organisation to reach most staff
   Show answer and explanationHide answer

   Correct answer: C

   A documented architecture with controls mapped to requirements, reviewed regularly, gives the program a measurable basis for improvement. Tools without architecture, team size and yearly events do not show whether the program is effective.

2. Question 2Information Security Risk Management

   Which role should own the decision to accept a residual risk for a business process?

   1. AThe information security manager, who runs the program that addresses the risk
   2. BThe external auditor, who reviews the risk after the decision has already been made
   3. CThe business process owner, who is accountable for the outcomes and the impact of the risk
   4. DThe IT help desk, which handles the support requests from users who are affected
   Show answer and explanationHide answer

   Correct answer: C

   The business process owner is accountable for the outcomes and bears the impact of the residual risk, so the decision belongs to them, with the security manager advising. Auditors review after the fact, and the help desk does not own business risk.

3. Question 3Information Security Governance

   The board asks how the information security strategy supports business objectives. Which artefact should the CISO present first?

   1. AThe vulnerability count from the latest scan, sorted by severity
   2. BA list of security tools bought last year, with their licence costs
   3. CA plan for the next penetration test, with the names of the testers
   4. DStrategy mapped to business goals, with progress metrics
   Show answer and explanationHide answer

   Correct answer: D

   A strategy mapped to business goals, with progress metrics, answers the board's question about alignment. A tool list, a test plan and a vulnerability count describe activity and do not show how security supports business objectives.

4. Question 4Incident Management

   A security incident is detected at 2 AM, and the team does not yet know its scope. What should the response team do first?

   1. ANotify all customers immediately, so that they can protect themselves from the attack
   2. BContain the incident by isolating the affected systems, after preserving the evidence needed
   3. CReimage every system in the company, so that any malware is removed before it spreads
   4. DWait until business hours, so that managers can approve each step before the team acts
   Show answer and explanationHide answer

   Correct answer: B

   Containment limits the damage, and preserving evidence supports the investigation and any legal or regulatory need. Notifying customers, reimaging everything and waiting for approval each act before the scope is known, and they can destroy evidence or delay the response.

5. Question 5Information Security Program

   The information security manager wants to measure whether the program is effective. Which type of metric is most useful?

   1. AActivity metrics that count how many security training sessions were run in the year
   2. BOutcome metrics that show whether the risk objectives are being achieved
   3. CVolume metrics that count how many emails were scanned and how many were blocked
   4. DCompliance metrics that show whether each form in the security file has been completed
   Show answer and explanationHide answer

   Correct answer: B

   Outcome metrics show whether the program is achieving its objectives, which is what effectiveness means. Activity, volume and form-completion metrics show work done rather than results.