Question

A newly appointed information security manager inherits a program with a fixed annual budget and staff of five analysts. The organization has approved three initiatives for the year: deploying a data loss prevention (DLP) solution, launching an enterprise-wide phishing simulation program, and upgrading the legacy identity and access management (IAM) platform. Resources are insufficient to fully execute all three simultaneously. What should the security manager do FIRST to determine how to allocate the limited resources?

Accepted Answer

Prioritize the initiatives according to their alignment with organizational risk and business objectives

Answer

Sequence the initiatives based on which vendor can deliver most quickly to show early program progress

Answer

Distribute the budget and staff equally across all three initiatives to demonstrate fairness

Answer

Defer the two most expensive initiatives and fully fund only the lowest-cost effort