Question

A newly appointed information security manager is tasked with developing an information security strategy for a manufacturing enterprise that has never had a formal strategy. Before proposing specific initiatives and investments, which of the following provides the MOST important foundation for the strategy?

Accepted Answer

Defining the desired state of security using business objectives and a recognized control framework

Answer

Conducting a penetration test to identify the enterprise's most critical technical vulnerabilities

Answer

Benchmarking the security budget against industry peers in the manufacturing sector

Answer

Selecting and deploying a security information and event management (SIEM) platform