Exam CISM topic 1 question 576 discussion

It's a tough choice between A and C. Actually the security strategy should be aligned with business objectives. The security governance is derived from the security strategy, so its inherent already. The main goal of security governance could be to reduce risk to an acceptable level, as a function of the security strategy. However, I still choose C - simply because I assume thats what ISACA wants to hear.

C. align with business objectives. The primary goal of information security governance is to align with business objectives. Information security governance is the process of establishing and maintaining a framework that ensures an organization's information security practices and measures are aligned with its overall business goals and objectives. While reducing risk to an acceptable level is an important aspect of information security governance, the ultimate aim is to ensure that security measures support and enhance the organization's broader business objectives. Alignment with business processes and the establishment of a security strategy are also important components of information security governance, but they serve the overarching goal of aligning with business objectives.

C. align with business objectives

The correct answer is C. align with business objectives.