Free ISACA CISM Actual Exam Questions - Question 4 Discussion

I get why D makes sense, but I think B is actually stronger here. Industry frameworks are recognized standards that guide how to structure and run an info security program effectively. Aligning with them helps ensure you’re not missing crucial elements and stay compliant with best practices across the board. The security strategy (D) is important but usually built on top of those frameworks, so B feels like the foundational alignment for long-term success.

Wouldn’t B also be strong since industry frameworks offer proven structures to build on?

I think D fits better here. The strategy sets the overall direction and goals, so aligning the program with the security strategy ensures it supports the organization’s priorities. Policies guide specific actions, but without strategic alignment, the program might miss the bigger picture or key risks.

It’s C. Without solid policies, the security program lacks clear rules and boundaries. Best practices and frameworks are useful, but policies actually define what’s expected and how to enforce it. Aligning with policies makes sure the program has a strong foundation and clear guidance.

Option D