Question

A newly appointed information security manager has documented the organization's desired future state for security, which is aligned with an approved governance framework and endorsed by executive management. Before developing a roadmap of initiatives to present for funding, what should the manager do NEXT?

Accepted Answer

Conduct an assessment of the current state of the security program to identify gaps against the desired state

Answer

Prioritize the most critical initiatives based on the highest-risk assets identified in the last audit

Answer

Benchmark the security budget against industry peers to justify the level of investment required

Answer

Draft key performance indicators to measure progress toward the desired state once initiatives begin