Certified Information Security Manager (CISM)Information Security GovernanceEasy
A CISO is presenting the annual information security strategy to the board of directors. The board is primarily concerned with the organization's overall risk exposure and compliance with new international data protection regulations. Which of the following should be the CISO's PRIMARY objective in this presentation?
- ATo request additional budget for advanced security tooling and increased staffing.
- BTo outline the technical architecture of the organization's defense-in-depth security controls.
- CTo provide a detailed report on the number of security incidents handled in the past year.
- DTo demonstrate how the security strategy aligns with business objectives, reduces risk, and ensures regulatory compliance.
Show answer & explanationAnswer & explanation
Correct answer: D. To demonstrate how the security strategy aligns with business objectives, reduces risk, and ensures regulatory compliance.
The CISO's primary objective should be to demonstrate how the security strategy aligns with business objectives, reduces risk, and ensures regulatory compliance. This directly addresses the board's concerns and translates security efforts into business-relevant terms.
Why the other options are wrong
- A. Requesting budget is an outcome, not the primary objective of demonstrating the strategy's value in addressing their concerns.
- B. Technical architecture is too detailed and not relevant to the board's strategic concerns about risk and compliance.
- C. Incident numbers are operational details; the board wants to know the strategic impact on risk and compliance.
Strategic Security Reporting
The process of communicating information security's strategic value, risk posture, and compliance status to executive leadership and the board, focusing on business impact rather than technical specifics.
- Aligns security with business goals.
- Addresses executive-level concerns (risk, compliance, ROI).
- Facilitates informed strategic decision-making.
Memory trick: Tell the board how security keeps the business safe and sound, not just what gadgets you bought.