Question

A newly appointed information security manager discovers that the organization's security program applies controls inconsistently, and several recent incidents involved systems that no one in IT was aware of. Before proposing new technical controls, which action will provide the MOST foundational basis for building an effective information security program?

Accepted Answer

Establish and maintain a complete inventory of information assets and their owners

Answer

Deploy an endpoint detection and response (EDR) solution across all known devices

Answer

Conduct enterprise-wide security awareness training for all employees

Answer

Purchase a cyber insurance policy to transfer residual risk from unknown systems