Question 69

Explanation

The correct answer: Establishing a security governance framework that aligns with the business objectives: The security function of a business must align directly with the business strategy in order to effectively safeguard the organization's goals and objectives. A security governance framework that aligns with the business objectives achieves this by integrating security into the strategic planning and operational activities of the business. It promotes a holistic approach that considers the full scope of the business strategy, including operations, resources, and processes. This ensures that the security function supports the business objectives instead of operating in isolation. By integrating security measures and considerations directly into the business strategy, the organization can ensure that security efforts support and enable the business goals rather than impede them. The incorrect answers: Implementing a comprehensive security awareness program: A comprehensive security awareness program is crucial for educating employees about their role in security, potential threats, and protective measures. It doesn't necessarily align the security function with the business strategy. It can help reduce risks and improve security behavior, it does not directly link the objectives of the security function with the larger business goals. It is a component of a broader security strategy, not a method of alignment with business strategy. Developing a security policy based on regulatory compliance is necessary to ensure that the organization adheres to the laws and regulations that govern its operations. This alone does not guarantee that the security function aligns with the business strategy. Compliance does not always equate to security, and a policy focused solely on meeting regulatory requirements may not cover all security risks relevant to the business strategy. Compliance-based policies should be a part of a wider security strategy that aligns with business objectives. Implementing security controls to protect an organization's assets is a critical aspect of any security program. These controls can include technical, physical, and administrative measures designed to safeguard data, systems, and infrastructure. Simply protecting assets does not ensure that the security function aligns with the broader business strategy. Alignment requires the security function to understand and support the business objectives, which may involve more than just asset protection. Protection of assets is a part of security, but it should be guided by a security strategy that aligns with the business objectives.