nerdexam
Isaca

CISM · Question #75

When an organization implements an information security governance framework, it is MOST important for executive leadership to have a direct role in:

The correct answer is A. reviewing the information security policy directing the organization. Executive leadership's most crucial role in information security governance is reviewing and endorsing the overarching information security policy, as this document sets the strategic direction.

Submitted by akirajp· Apr 18, 2026Information Security Governance

Question

When an organization implements an information security governance framework, it is MOST important for executive leadership to have a direct role in:

Options

  • Areviewing the information security policy directing the organization.
  • Bdeveloping technical key risk indicators (KRIs) for information security.
  • Cimplementing information security metrics for the organization.
  • Dapproving information security standards and procedures for the organization.

How the community answered

(40 responses)
  • A
    78% (31)
  • B
    5% (2)
  • C
    3% (1)
  • D
    15% (6)

Why each option

Executive leadership's most crucial role in information security governance is reviewing and endorsing the overarching information security policy, as this document sets the strategic direction.

Areviewing the information security policy directing the organization.Correct

Executive leadership is responsible for setting the strategic direction and tone at the top for information security. Reviewing the information security policy ensures that the policy aligns with business objectives, risk appetite, and legal/regulatory requirements, demonstrating their commitment and providing authoritative direction for the entire organization.

Bdeveloping technical key risk indicators (KRIs) for information security.

Developing technical KRIs is typically a task for security management and operational teams, as it requires specific technical knowledge and operational context.

Cimplementing information security metrics for the organization.

Implementing information security metrics is an operational responsibility usually carried out by security management and their teams, not directly by executive leadership.

Dapproving information security standards and procedures for the organization.

While executive leadership may ultimately approve standards and procedures, their *most important direct role* is in the higher-level policy review, which dictates the need for those standards and procedures.

Concept tested: Executive leadership role in security governance

Source: https://learn.microsoft.com/en-us/compliance/regulatory/auditing-security-and-governance

Topics

#Executive Leadership#Information Security Governance#Security Policy#Framework Implementation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CISM Practice