Certified Information Security Manager (CISM)Information Security GovernanceEasy
A CISO is establishing an information security governance framework for a newly formed organization. Which of the following is the MOST critical initial step to ensure the framework aligns with enterprise objectives?
- ASelect and deploy an advanced security information and event management (SIEM) system.
- BIdentify and understand the organization's strategic objectives and business drivers.
- CDevelop a comprehensive incident response plan.
- DImplement a security awareness training program for all employees.
Show answer & explanationAnswer & explanation
Correct answer: B. Identify and understand the organization's strategic objectives and business drivers.
Effective information security governance must be integrated with and support the overall enterprise governance. Understanding strategic objectives ensures security efforts contribute directly to business success, making it the most critical initial step.
Why the other options are wrong
- A. Deploying a SIEM is a technical implementation, not a foundational governance step.
- C. Developing an incident response plan is important but follows the establishment of strategic alignment.
- D. Security awareness training is a critical control but not the initial step in establishing governance.
Strategic Alignment in InfoSec Governance
Ensuring that information security objectives and activities are directly supportive of and integrated with the organization's overall business strategy and goals.
- Foundation for effective security governance.
- Ensures security investments provide business value.
- Prevents security from being a siloed function.
Memory trick: Build security on business goals, not just tech.