Certified Information Security Manager (CISM)Information Security GovernanceHard
The board of directors of a software development company is concerned about the organization's ability to quickly adapt its security posture to emerging threats and changing business priorities. The CISO needs to demonstrate how the information security governance framework supports this agility. Which of the following governance characteristics BEST addresses the board's concern?
- AA principles-based policy framework that allows for flexible implementation and interpretation.
- BCentralized decision-making for all security-related matters to maintain control.
- CExclusive reliance on industry-standard security certifications for compliance.
- DStrict adherence to a rigid, annually reviewed security policy framework.
Show answer & explanationAnswer & explanation
Correct answer: A. A principles-based policy framework that allows for flexible implementation and interpretation.
A principles-based policy framework provides high-level guidance rather than prescriptive rules, allowing teams to adapt specific implementations to new threats or business needs without requiring constant policy revisions. This fosters agility while maintaining alignment with overall security objectives.
Why the other options are wrong
- B. Centralized decision-making can be slow and bureaucratic, hindering agile responses to emerging threats.
- C. While certifications are valuable, they represent a baseline and do not inherently provide the agility needed to respond to dynamic threats and business changes.
- D. Rigid, annually reviewed policies are antithetical to agility, as they are slow to adapt to rapid changes.
Principles-Based Policy Framework
An information security policy framework that focuses on high-level principles and objectives rather than detailed, prescriptive rules, allowing for greater flexibility and adaptability in implementation.
- Promotes agility and innovation.
- Requires strong security culture for effective interpretation.
- Adapts well to evolving threats and business needs.
Memory trick: Principles give freedom, rules tie you down.