nerdexam
Isaca

CISM · Question #74

Before approving the implementation of a new security solution, senior management requires a business case. Which of the following would BEST support the justification for investment?

The correct answer is A. The solution contributes to business strategy.. To justify a new security solution investment to senior management, the best business case demonstrates that the solution directly contributes to the overall business strategy.

Submitted by asante_acc· Apr 18, 2026Information Security Governance

Question

Before approving the implementation of a new security solution, senior management requires a business case. Which of the following would BEST support the justification for investment?

Options

  • AThe solution contributes to business strategy.
  • BThe solution improves business risk tolerance levels.
  • CThe solution reduces the cost of noncompliance with regulations.
  • DThe solution improves business resiliency.

How the community answered

(36 responses)
  • A
    83% (30)
  • B
    8% (3)
  • C
    6% (2)
  • D
    3% (1)

Why each option

To justify a new security solution investment to senior management, the best business case demonstrates that the solution directly contributes to the overall business strategy.

AThe solution contributes to business strategy.Correct

The best justification for a new security solution investment to senior management is demonstrating that the solution contributes directly to the overall business strategy. This aligns security initiatives with the organization's overarching goals, showing that security is an enabler of business objectives rather than just a cost center or compliance requirement, which resonates most powerfully with strategic decision-makers.

BThe solution improves business risk tolerance levels.

Improving business risk tolerance levels is an outcome of security, but linking the solution to the broader business strategy provides a more compelling and higher-level justification for senior management.

CThe solution reduces the cost of noncompliance with regulations.

Reducing the cost of noncompliance with regulations is an important benefit, but it is often a tactical or operational justification, whereas contributing to overall business strategy is a higher-level, more impactful argument.

DThe solution improves business resiliency.

Improving business resiliency is a key benefit of security, but like risk tolerance and compliance, it's a specific aspect; contributing to the entire business strategy encompasses these benefits and presents a more comprehensive and strategic justification.

Concept tested: Justifying security investments

Topics

#Business alignment#Strategic investment#Business case#Senior management

Community Discussion

No community discussion yet for this question.

Full CISM Practice