Executive Role in Security Governance

CISM By islever Editorial Last updated Sep 8, 2026

Short answer

A Reviewing the information security policy directing the organization.

Question

When an organization implements an information security governance framework, it is MOST important for executive leadership to have a direct role in:

reviewing the information security policy directing the organization. Correct Answer
developing technical key risk indicators (KRIs) for information security.
implementing information security metrics for the organization.
approving information security standards and procedures for the organization.

Key Takeaways

This question tests the distinction between policy and standards, where the common trap is assuming executives approve low-level implementation documents like standards.

In information security governance, executive leadership must primarily ensure high-level alignment, making the review and direction of the information security policy their most critical responsibility.

Common mistake: Many candidates choose Option D because executives typically 'approve' documents, but they fail to recognize that standards and procedures are operational details, not high-level governance instruments.

Expert Analysis

Why the Answer Is Correct

Option A is correct because information security governance relies on the "tone at the top." Executive leadership is responsible for ensuring the security policy aligns with business objectives and risk appetite. By reviewing the policy, they provide the necessary authority and direction for the entire program.

Why the Other Options Are Wrong

Option B is incorrect because developing technical Key Risk Indicators (KRIs) is a managerial or operational task, not an executive function. Option C is incorrect because implementing metrics is an operational activity. Option D is incorrect because approving standards and procedures is generally delegated to middle management or security architects; these are too granular for executive review.

Community Comment Notes

Community members correctly identified that executives focus on high-level policy rather than detailed standards. One user emphasized that standards are "low level documents," reinforcing the governance hierarchy where executives own the policy, not the technical implementation details.

Official Reference

https://www.isaca.org/credentialing/cism

This link opens the official vendor documentation in a new tab.

Exam Strategy

Remember the governance hierarchy: Policy (Executives) -> Standards (Management) -> Procedures (Staff). Focus on the "tone at the top" concept for governance questions.

Community Votes

67%

33%

67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

Booict 👍 4

D - approving information security standards and procedures for the organization”. While direct review by executives may not occur, their approval ensures alignment with organizational goals, risk management, and compliance. This is according to according to CISM principles. Not sure why the answer is A.
Raj91188 👍 3 Answered A

It's clearly A, not D. Executives do not approve standards and procedures, they are low level documents, Executives approve Security policy.
pgonza 👍 2 Answered D

Executive (board) will only approve
david124 👍 1 Answered A

idk guys looks like A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All CISM Questions

Access 400 questions with complete answers and detailed explanations.

View Full CISM Practice Test →

← Back to CISM Study Guide