QUESTION: 149

When developing an information security governance framework, which of the following would be the MAINimpact when lacking senior management involvement?

Accountability for risk treatment is not clearly defined.
Information security responsibilities are not communicated effectively.
Resource requirements are not adequately considered.
Information security plans do not support business requirements.

Answer(s): C

Reveal Solution Next Question

QUESTION: 150

Which of the following is the BEST way to facilitate the alignment between an organization’s information security program and business objectives?

Information security is considered at the feasibility stage of all IT projects.
The information security governance committee includes representation from key business areas.
The chief executive officer reviews and approves the information security program.
The information security program is audited by the internal audit department.

Answer(s): B

Reveal Solution Next Question