Certified Information Security Manager (CISM)Information Security GovernanceMedium
A CISO is establishing an information security steering committee to provide strategic direction and oversight for the organization's security program. To ensure the committee is effective and its decisions are supported across the enterprise, which of the following is the MOST important consideration for committee composition?
- AInviting external security consultants to provide an unbiased perspective.
- BComprising representatives from all major business units and executive management.
- CIncluding only senior IT security technical experts to ensure deep technical understanding.
- DLimiting membership to the CISO and direct reports to streamline decision-making.
Show answer & explanationAnswer & explanation
Correct answer: B. Comprising representatives from all major business units and executive management.
An effective security steering committee requires broad representation from major business units and executive management. This ensures security decisions align with business objectives, have enterprise-wide support, and consider diverse perspectives beyond just technical or security-specific viewpoints.
Why the other options are wrong
- A. External consultants can provide input, but they should not form the core composition of an internal steering committee responsible for ongoing strategic oversight.
- C. While technical expertise is valuable, a steering committee's role is strategic and requires business context, not just technical depth.
- D. Limiting membership to the security team would negate the purpose of a steering committee, which is to gain broader enterprise input and support.
InfoSec Steering Committee Composition
The selection of members for an information security steering committee, emphasizing diverse representation from business units, executive leadership, and relevant departments to ensure strategic alignment and enterprise-wide support.
- Crucial for strategic alignment.
- Ensures broad organizational buy-in.
- Facilitates resource allocation and prioritization.
- Avoids security operating in a silo.
Memory trick: Diverse voices steer the security ship.