Question

A newly hired CISO at a mid-sized financial services firm discovers that the security program operates independently, with technical controls chosen by the IT team based on industry trends rather than any documented connection to the firm's strategic goals. The board complains that security spending appears disconnected from business priorities and cannot demonstrate value. Which action should the CISO take FIRST to correct this governance deficiency?

Accepted Answer

Establish a security steering committee that maps security initiatives and investments to the organization's business objectives and risk appetite

Answer

Deploy a new SIEM platform to improve visibility and demonstrate measurable technical improvements to the board

Answer

Conduct a penetration test to identify the most urgent vulnerabilities requiring immediate remediation funding

Answer

Adopt the most widely used industry control framework and implement all of its baseline controls across the enterprise