An enterprise has decided to implement an IT risk management program After establishing stakeholder desired outcomes, the MAIN goal of the IT strategy committee should be to:

Identifying business data that requires protection is a tactical activity typically performed by data owners, data custodians, or risk analysts, not the strategic IT strategy committee.

Performing a risk analysis on key IT processes is an operational or analytical task executed by risk management teams, not the strategic IT strategy committee.

Implementing controls to address high-risk areas is an operational task for IT and security teams, guided by risk assessments, but not the direct responsibility of the strategic IT strategy committee.

The IT strategy committee operates at a strategic level. Its main goal in an IT risk management program, especially after stakeholder outcomes are established, is to ensure that IT risks are managed in a way that supports and aligns with the broader enterprise risk management framework and overall business objectives. This ensures a consistent approach to risk across the organization.