Question

A newly appointed information security manager finds that the security function currently reports directly to the head of IT operations. The manager is concerned that this arrangement may compromise the objectivity of security decisions, particularly when security controls conflict with operational uptime targets. Which of the following is the BEST recommendation to address this governance concern?

Accepted Answer

Establish a reporting line that provides the security function with sufficient independence from operational management, such as reporting to executive leadership or a governance body

Answer

Retain the current reporting structure but require the IT operations head to document all decisions where security recommendations are overridden

Answer

Move the security function to report to the internal audit department to guarantee independent oversight

Answer

Create a peer-level relationship in which security and IT operations jointly approve all control decisions before implementation