Which of the following represents the best method of ensuring business unit alignment with security program requirements?

Question

Options

• AProvide clear communication of security requirements throughout the organization
• BDemonstrate executive support with written mandates for security policy adherence
• CCreate collaborative risk management approaches within the organization
• DPerform increased audits of security processes and procedures

• A
  14% (7)
• B
  4% (2)
• C
  75% (38)
• D
  8% (4)

Explanation

Collaborative risk management (C) is the best method because it actively involves business units in identifying and managing risks, creating shared ownership and genuine buy-in rather than top-down compliance. When business units co-create security decisions, they understand the "why" behind requirements and are far more likely to align their behavior accordingly.

Why the distractors fall short:

• A (communication) is necessary but passive - broadcasting requirements doesn't ensure people internalize or act on them.
• B (executive mandates) creates compliance through authority, which often produces checkbox behavior rather than true alignment and can breed resentment.
• D (increased audits) is a detective/corrective control that measures after the fact; it enforces rather than aligns, and is resource-intensive with diminishing returns.

Memory tip: Think of alignment as a pull, not a push - collaboration pulls business units toward security goals voluntarily, while mandates and audits push from the outside. "Align" rhymes with "design together."

No community discussion yet for this question.