Certified Information Security Manager (CISM)Information Security ProgramEasy
A CISO is establishing an information security program for a newly formed financial technology (FinTech) startup. The board of directors is primarily concerned with rapid market entry and demonstrating compliance to potential investors. Which of the following should be the CISO's PRIMARY focus when initially developing the security program?
- AEstablishing foundational policies and controls to meet critical regulatory requirements and investor expectations.
- BDeveloping an advanced threat intelligence and incident response capability.
- CConducting a detailed risk assessment across all emerging business processes and technologies.
- DImplementing a comprehensive security architecture based on zero-trust principles.
Show answer & explanationAnswer & explanation
Correct answer: A. Establishing foundational policies and controls to meet critical regulatory requirements and investor expectations.
In a startup environment, especially FinTech, demonstrating compliance and meeting investor expectations for security is paramount for business viability. Establishing foundational policies and controls directly addresses these immediate needs.
Why the other options are wrong
- B. Advanced threat intelligence is a more mature capability and not the primary initial focus for a new program.
- C. A detailed risk assessment is crucial but must be guided by initial policy and compliance requirements; it's a step within establishing the foundation, not the primary initial focus itself.
- D. While important, a comprehensive zero-trust architecture is typically a later-stage implementation for a nascent program.
Foundational Security Program Elements
The initial essential components of an information security program, focusing on basic governance, compliance, and risk management to support immediate business objectives.
- Prioritizes regulatory compliance and investor confidence for startups.
- Establishes core policies, procedures, and basic controls.
- Aims for rapid, demonstrable security posture.
Memory trick: First, Build the Base, then Reach for Space.