Question

A newly appointed information security manager observes that the organization's security program lacks clear separation between strategic direction-setting and day-to-day operational execution. Executives frequently make operational security decisions, while the security team independently sets risk appetite without executive input. To correct this, which distinction should the manager emphasize when redefining roles and responsibilities?

Accepted Answer

Governance establishes objectives, risk appetite, and oversight, while management implements and operates controls to achieve those objectives

Answer

Governance handles technical control configuration, while management sets the long-term security budget

Answer

Governance is performed exclusively by the security team, while management is performed by external auditors

Answer

Governance and management are interchangeable functions that should both be owned by the security operations team