Certified Information Security Manager (CISM)Information Security ProgramHard
A CISO is tasked with developing an information security program for a large, complex organization with multiple business units, each having unique operational requirements and risk profiles. To ensure the program is both comprehensive and adaptable, which of the following approaches should the CISO adopt?
- AEstablish a centralized core security framework with customizable overlays for individual business units.
- BImplement a single, monolithic security framework that applies uniformly to all business units.
- CPrioritize the deployment of advanced security technologies over policy development.
- DEmpower each business unit to develop and manage its own independent security programs.
Show answer & explanationAnswer & explanation
Correct answer: A. Establish a centralized core security framework with customizable overlays for individual business units.
A centralized core framework ensures consistency and baseline security across the organization while allowing for customizable overlays. This approach provides the flexibility needed to address unique business unit requirements and risk profiles without sacrificing overall program coherence.
Why the other options are wrong
- B. A monolithic framework may be too rigid for diverse business units, leading to resistance and ineffectiveness in addressing specific risks.
- C. Technology alone is not a comprehensive program; policies and frameworks are essential to guide technology deployment and overall strategy.
- D. Independent programs would lead to fragmentation, inconsistency, and potential gaps in overall organizational security posture.
Federated Security Program
An information security program model that combines centralized governance and core controls with decentralized implementation and customization to meet the specific needs of diverse business units.
- Balances consistency with flexibility.
- Addresses unique business unit requirements.
- Maintains overall organizational security posture.
Memory trick: Like a global company, security needs a central headquarters with local offices that can adapt.