Certified Information Security Manager (CISM)Information Security GovernanceEasy
A CISO is developing an information security strategy for a manufacturing company that emphasizes operational efficiency and cost reduction. Which of the following approaches BEST ensures that the security strategy supports these organizational objectives?
- APrioritizing the implementation of advanced security technologies to achieve the highest possible security posture.
- BImplementing a comprehensive security awareness program to reduce human error across all departments.
- CBenchmarking security spending against industry averages to ensure competitive cost efficiency.
- DFocusing on security controls that automate processes and reduce manual intervention, thereby cutting operational costs.
Show answer & explanationAnswer & explanation
Correct answer: D. Focusing on security controls that automate processes and reduce manual intervention, thereby cutting operational costs.
To align with organizational objectives of operational efficiency and cost reduction, the security strategy should prioritize controls that automate processes and reduce manual effort. This directly contributes to both efficiency and cost savings.
Why the other options are wrong
- A. Highest security posture might be expensive and not align with cost reduction unless justified by risk.
- B. While important, a security awareness program primarily reduces risk from human error, not necessarily directly improving operational efficiency or cutting costs in a measurable way compared to automation.
- C. Benchmarking spending is a reactive measure and doesn't inherently ensure efficiency or direct cost reduction.
Business-Aligned Security Strategy
An information security strategy that is developed to directly support and contribute to the overarching business objectives and priorities of the organization.
- Security as a business enabler, not just a cost center.
- Prioritizes security investments based on business value.
- Integrates security into business processes.
Memory trick: Security should oil the business gears, not jam them.