The newly appointed CISO of an organization is reviewing the IT security strategic plan. Which of the following is the MOST important component of the strategic plan?

Question

Options

• AThere is integration between IT security and business staffing.
• BThere is a clear definition of the IT security mission and vision.
• CThere is an auditing methodology in place.
• DThe plan requires return on investment for all security projects.

• A
  12% (6)
• B
  76% (39)
• C
  8% (4)
• D
  4% (2)

Explanation

A strategic plan's foundational element is its mission and vision statement - without a clear articulation of why the security function exists and where it's headed, every other initiative lacks direction and alignment. Option A (staffing integration) is a tactical HR concern, not a strategic foundation. Option C (auditing methodology) is an operational process that supports execution but doesn't define strategy. Option D (ROI requirements) is a governance constraint that can actually undermine security investments, since many critical controls (e.g., compliance, risk mitigation) don't have a calculable return.

Memory tip: Think of a strategic plan like a GPS - the mission/vision is the destination you enter first. You can't plan the route (auditing, staffing, budgets) until you know where you're going.

No community discussion yet for this question.