Certified Information Security Manager (CISM)Information Security GovernanceEasy
A CISO is presenting the annual information security strategy to the board of directors. The board members are primarily concerned with financial performance and market competitiveness. Which of the following approaches should the CISO use to BEST align the security strategy with the board's priorities?
- AFocus on technical metrics like vulnerability counts and patch cycles to demonstrate operational efficiency.
- BDetail the compliance requirements and potential legal penalties for non-adherence to regulations.
- CHighlight how security investments enable new business initiatives and protect brand reputation and customer trust.
- DPresent a comprehensive list of all implemented security controls and their technical specifications.
Show answer & explanationAnswer & explanation
Correct answer: C. Highlight how security investments enable new business initiatives and protect brand reputation and customer trust.
To align with a board focused on financial performance and market competitiveness, the CISO should articulate how security directly supports business objectives, enabling growth, protecting revenue streams, and enhancing brand value.
Why the other options are wrong
- A. Technical metrics are important for security operations but do not resonate directly with a board's financial and market concerns.
- B. While important, focusing solely on penalties can be seen as fear-mongering and may not convey the strategic value of security in driving business success.
- D. A detailed list of controls is too technical and does not provide the strategic, business-oriented view the board requires.
Business Alignment of Security
The process of ensuring that information security strategies, objectives, and investments directly support and enable the overarching business goals and objectives of an organization.
- Translates security benefits into business value.
- Crucial for gaining executive buy-in and resource allocation.
- Focuses on enabling growth, protecting assets, and maintaining trust.
Memory trick: Speak the board's language: money, growth, and reputation.