Certified Information Security Manager (CISM)Information Security GovernanceEasy
A CISO is tasked with establishing an information security governance framework for a newly formed organization. Which of the following is the MOST fundamental first step in this process?
- ADefining the organization's information security objectives and aligning them with business goals.
- BImplementing an intrusion detection system (IDS) to monitor network traffic.
- CDeveloping detailed security policies for every department immediately.
- DConducting a comprehensive technical vulnerability assessment of all systems.
Show answer & explanationAnswer & explanation
Correct answer: A. Defining the organization's information security objectives and aligning them with business goals.
The most fundamental first step in establishing an information security governance framework is to define clear security objectives that support the organization's overall business goals. Without this foundational alignment, subsequent security efforts may not address the most critical risks or provide value.
Why the other options are wrong
- B. Implementing security tools is a tactical step that follows strategic planning, not the first step in governance.
- C. Developing policies prematurely without established objectives and a framework can lead to misaligned or ineffective policies.
- D. Vulnerability assessments are important operational activities, but they come after establishing the governance framework and objectives.
InfoSec Governance Foundation
The initial phase of establishing information security governance involves defining objectives and aligning them with organizational strategy to ensure security supports business goals.
- Establishes purpose and direction for security.
- Ensures security investments provide business value.
- Precedes detailed policy and control implementation.
Memory trick: Start with the 'Why' before the 'What'.