Question

A newly appointed information security manager has developed a security strategy endorsed by the steering committee. However, the annual budget approved by the board funds only about half of the initiatives outlined in the strategy roadmap. Which of the following should the security manager do FIRST to determine how to proceed?

Accepted Answer

Prioritize the funded initiatives based on the results of a risk assessment aligned to business objectives

Answer

Return to the board and request that the full budget be approved before implementation begins

Answer

Implement the least expensive initiatives first to demonstrate quick wins to management

Answer

Defer all strategy execution until the following fiscal year when full funding may be available