A CISO is developing an information security program for a newly established FinTech startup. The startup operates in a highly regulated industry and aims for rapid growth. Which of the following should be the CISO's PRIMARY focus when initially structuring the program?
- AImplementing advanced threat intelligence feeds and security analytics platforms.
- BHiring a large team of security analysts to manage 24/7 security operations.
- CEstablishing a strong governance framework aligned with business objectives and regulatory requirements.
- DDeploying a comprehensive suite of endpoint detection and response (EDR) tools.
Show answer & explanationAnswer & explanation
Correct answer: C. Establishing a strong governance framework aligned with business objectives and regulatory requirements.
For a startup in a highly regulated industry, establishing a strong governance framework is paramount. This framework will ensure that the security program is aligned with business objectives, meets regulatory obligations from the outset, and provides the foundation for all subsequent security initiatives, rather than jumping straight to specific technical controls or operational staffing.
Why the other options are wrong
- A. Advanced threat intelligence is important but comes after foundational governance and alignment.
- B. Staffing for 24/7 operations is a later stage operational concern; initial focus should be on strategic foundation.
- D. EDR tools are specific technical controls, important but not the primary foundational element for program structuring.
Information Security Governance
Information security governance is the system by which an organization directs and controls information security activities, ensuring alignment with business objectives, regulatory requirements, and risk tolerance.
- Provides strategic direction.
- Defines roles, responsibilities, and decision-making processes.
- Ensures compliance and manages risk at an organizational level.
Memory trick: Build the house on a strong foundation of rules and purpose.