Which of the following represents the BEST method of ensuring security program alignment to business needs?

Question

Options

• ACreate a comprehensive security awareness program and provide success metrics to business
• BCreate security consortiums, such as strategic security planning groups, that include business
• CEnsure security implementations include business unit testing and functional validation prior to
• DEnsure the organization has strong executive-level security representation through clear

• B
  84% (16)
• C
  5% (1)
• D
  11% (2)

Explanation

Option B is correct because creating strategic security planning groups that include business stakeholders embeds alignment into the governance structure itself - business leaders actively co-own security decisions rather than receiving them after the fact, ensuring security initiatives map directly to business objectives, risk appetite, and operational priorities.

Why the distractors fall short:

• A (awareness programs + metrics) is a communication and measurement activity, not a structural mechanism for alignment - it informs the business but doesn't give them a seat at the table.
• C (business unit testing/validation) is an important delivery practice, but it addresses individual implementations rather than the ongoing, strategic relationship between security and business.
• D (executive-level security representation) supports visibility and authority, but representation alone doesn't create the two-way collaboration needed for true alignment - executives can still operate in silos.

Memory tip: Think of B as building a bridge, not a bulletin board. Consortiums and planning groups create a permanent, two-way channel where security and business co-navigate direction together - the other options are one-way broadcasts (A, D) or point-in-time checkpoints (C).

No community discussion yet for this question.