Question

A newly appointed information security manager reviews the organization's documentation and finds a single 80-page document that mixes high-level intent statements, mandatory technical configuration baselines, and step-by-step instructions for configuring firewalls. Business units complain the document is unwieldy and quickly outdated. To improve governance and enable the document to remain aligned with business goals over time, what should the security manager do FIRST?

Accepted Answer

Restructure the content into a hierarchy of policy, standards, and procedures with distinct ownership and review cycles

Answer

Delete the outdated technical instructions and retain only the high-level intent statements

Answer

Assign the entire document to the IT operations team to keep the firewall instructions current

Answer

Submit the existing document to the board for annual reapproval to establish authority