Certified Information Security Manager (CISM)Information Security Risk ManagementEasy
An organization is developing its information security program. The information security manager is tasked with ensuring that security initiatives are aligned with the overall business strategy and objectives. Which of the following activities is MOST crucial for achieving this business-security alignment?
- ARegularly reporting security metrics such as vulnerability counts and patch compliance to the IT department.
- BImplementing a comprehensive set of security controls based on a recognized framework like NIST CSF.
- CEngaging with business leaders to understand their strategic goals and critical assets.
- DConducting annual security awareness training for all employees.
Show answer & explanationAnswer & explanation
Correct answer: C. Engaging with business leaders to understand their strategic goals and critical assets.
To align security with business strategy, the information security manager must first understand what the business is trying to achieve and what assets are most critical to those objectives. Engaging with business leaders directly provides this crucial insight, forming the foundation for a business-aligned security program.
Why the other options are wrong
- A. Reporting to IT is an operational task; business alignment requires engagement with broader business leadership.
- B. Implementing controls is important, but without understanding business goals, these controls might not be optimally aligned.
- D. Security awareness training is a vital control but doesn't directly establish the strategic alignment of the security program itself.
Business-Security Alignment
The process of ensuring that information security strategies, objectives, and investments support and enable the overall business goals and mission of an organization.
- Security as a business enabler.
- Requires communication with leadership.
- Prioritizes protection of critical assets.
Memory trick: Talk to the business to protect what truly matters to them.