Question

A newly appointed CRISC-certified risk practitioner reviews the information security department's annual goals. The goals emphasize maximizing the number of vulnerabilities patched and increasing firewall rule counts, but make no reference to the enterprise's stated strategic objective of expanding into new digital markets. Which action should the practitioner recommend FIRST to improve governance?

Accepted Answer

Reframe the security department goals so they demonstrably support and enable the enterprise's strategic business objectives

Answer

Increase the vulnerability patching targets to further reduce technical risk exposure

Answer

Require the security team to report firewall rule metrics directly to the board each quarter

Answer

Escalate the misalignment to internal audit for a formal control deficiency finding