Question

A newly appointed information security manager finds that security decisions across the enterprise are made inconsistently — IT approves some risk exceptions, business units approve others, and there is no coordinated forum for prioritizing security investments. Executives complain that security initiatives lack business buy-in and frequently stall. Which action would MOST effectively address the root cause of these governance problems?

Accepted Answer

Establish a cross-functional information security steering committee with executive and business unit representation to set direction and prioritize investments

Answer

Hire additional security analysts to review and approve all risk exceptions centrally within the security team

Answer

Deploy a governance, risk, and compliance (GRC) tool to automate the tracking of security decisions and exceptions

Answer

Require the information security manager to personally approve all security-related decisions across the enterprise