Question

A newly appointed information security manager discovers that the organization's security program operates without a formal charter. Security decisions are frequently overturned by business unit leaders who claim security has no authority to mandate controls. To establish legitimate, enterprise-wide authority for the security function, what should the security manager do FIRST?

Accepted Answer

Obtain board or executive-level approval of a security governance charter that defines the program's mandate and authority

Answer

Draft a comprehensive set of security policies and require all business units to sign attestations of compliance

Answer

Implement technical enforcement controls that prevent business units from bypassing security requirements

Answer

Escalate individual disputes to the audit committee each time a business leader overrides a security decision