Question

A newly appointed information security manager finds that security decisions are made informally within the IT department and are not visible to or endorsed by the enterprise's existing corporate governance structures (board committees, risk committee, and audit committee). The manager wants information security to become a sustainable part of how the organization is directed and controlled. Which action would BEST achieve this objective?

Accepted Answer

Integrate information security oversight into the existing enterprise governance framework so that security objectives, risk, and reporting align with board-level committees

Answer

Deploy a governance, risk, and compliance (GRC) tool to automate the collection of security control evidence across the IT department

Answer

Create a standalone information security governance body that operates independently of the enterprise's corporate governance structures

Answer

Publish a comprehensive set of security policies and require all IT staff to formally acknowledge them