Pass CISM Exam Guide

 The best way to ensure information security governance is aligned with corporate governance is to integrate security reporting into corporate reporting. This will enable the board and senior management to oversee and monitor the performance and effectiveness of the information security program, as well as the alignment of information security objectives and strategies with business goals and risk appetite. Security reporting should provide relevant, timely, accurate, and actionable information to support decision making and accountability. The other options are important components of information security governance, but they do not ensure alignment with corporate governance by themselves. References = CISM Review Manual 15th Edition, page 411; CISM Review Questions, Answers & Explanations Database - 12 Month Subscription, Question ID: 1027

New business initiatives are the most important consideration, as security must align with business changes to effectively protect assets and support growth.

“The security strategy must be aligned with new business initiatives to ensure it continues to protect critical assets and support enterprise goals.”

— CISM Review Manual 15th Edition, Chapter 1: Information Security Governance, Section: Business Alignment*

ISACA practice questions stress that aligning with new business initiatives ensures relevance and effectiveness.

Consistent security is the primary reason for integrating the various assurance functions of an organization for the information security manager because it ensures that the security policies and standards are applied uniformly and effectively across different domains, processes, and systems of the organization. Comprehensive audits are not the primary reason for integrating the various assurance functions, but rather a possible outcome or benefit of doing so. A security-aware culture is not the primary reason for integrating the various assurance functions, but rather a desirable state or goal of the organization. Compliance with policy is not the primary reason for integrating the various assurance functions, but rather a basic requirement or expectation of the organization. References:

The correct answer is A because integrity is the information security principle that protects data from unauthorized, improper, or accidental modification. Integrity ensures that information remains accurate, complete, and reliable throughout its life cycle. Controls supporting integrity may include access control, hashing, checksums, digital signatures, change management, database constraints, audit logging, and segregation of duties. Availability addresses whether information and systems are accessible when needed, not whether data has been modified. Nonrepudiation provides assurance that a party cannot deny performing an action, such as sending a message or approving a transaction. Authenticity confirms that an entity or message is genuine, but it does not directly define protection from unauthorized modification. In the classic confidentiality, integrity, and availability model, unauthorized modification is directly tied to integrity. CISM expects candidates to understand these foundational principles and apply them to risk and control decisions. Therefore, the principle that best addresses protection from unauthorized modification is integrity.