Question

A newly appointed information security manager at a mid-sized financial services firm discovers that the organization's information security policies were written years ago and reference no external standard. The board has asked for assurance that the security program reflects recognized good practice and can be benchmarked against peers. Which action should the security manager take FIRST to address the board's request?

Accepted Answer

Select and adopt an appropriate industry framework or standard that aligns with the firm's business objectives and regulatory context

Answer

Immediately rewrite all existing policies to include detailed technical control statements

Answer

Purchase a governance, risk, and compliance (GRC) tool to automate control tracking

Answer

Schedule an external penetration test to demonstrate the current security posture to the board