Certified Information Security Manager (CISM)Information Security GovernanceEasy
A CISO is establishing an information security governance framework for a newly formed organization. Which of the following is the MOST critical initial step to ensure the framework effectively supports business objectives?
- APurchasing and deploying advanced security information and event management (SIEM) tools.
- BImplementing a security awareness training program for all employees.
- CAligning the security strategy with the organization's overall business strategy.
- DDeveloping a comprehensive incident response plan.
Show answer & explanationAnswer & explanation
Correct answer: C. Aligning the security strategy with the organization's overall business strategy.
The most critical initial step in establishing an information security governance framework is to align it with the organization's overall business strategy. This ensures that security efforts directly contribute to achieving business objectives and are not seen as a separate, isolated function. Without this alignment, security initiatives may lack direction and organizational buy-in.
Why the other options are wrong
- A. Deploying SIEM tools is a tactical implementation of security controls, which comes much later in the framework establishment process.
- B. While important, security awareness training is a subsequent implementation step, not the foundational strategic alignment.
- D. An incident response plan is a crucial operational component, but it is built upon the foundation of a strategically aligned security framework.
Strategic Alignment (InfoSec)
Ensuring that information security objectives, strategies, and investments directly support and enable the organization's overall business goals and mission.
- Security initiatives should contribute to business value.
- Avoids security being an isolated 'cost center'.
- Crucial for gaining executive buy-in and resource allocation.
Memory trick: Strategy's compass points to business success.