Question

A newly appointed information security manager discovers that the organization has multiple security initiatives underway, each championed by a different business unit and funded from separate budgets. The initiatives frequently overlap, and there is no clear link between them and the enterprise's stated business objectives. The board has asked the manager to bring order to these efforts. Which action should the manager take FIRST?

Accepted Answer

Develop an information security strategy that aligns security objectives with the enterprise's business goals

Answer

Consolidate all initiative budgets under the security function to gain centralized spending control

Answer

Halt all current initiatives until a comprehensive risk assessment of each has been completed

Answer

Implement a security awareness program to improve organizational culture around security