Which of the following is MOST helpful in the development of a cost-effective information security strategy that is aligned with business requirements?

The correct answer is A. Categorizing information assets. Categorizing information assets is the foundation of a cost-effective, business-aligned security strategy because it lets you understand what you're protecting, its relative value to the business, and the appropriate level of controls to apply - preventing both under- and over-in

Submitted by viktor_hu· Apr 18, 2026Information Security Program Development and Management

Question

Options

ACategorizing information assets
BEnforcing data retention
CDeveloping policy standards
DBenchmarking against industry peers

How the community answered

(20 responses)

A
75% (15)
B
5% (1)
C
15% (3)
D
5% (1)

Explanation

Categorizing information assets is the foundation of a cost-effective, business-aligned security strategy because it lets you understand what you're protecting, its relative value to the business, and the appropriate level of controls to apply - preventing both under- and over-investment in security.

Why the distractors fall short:

B (Enforcing data retention) is an operational/compliance activity that follows from strategy, not one that shapes it.
C (Developing policy standards) is also downstream - you can't write meaningful policies until you know what assets exist and their criticality.
D (Benchmarking against peers) tells you what others do, not what your business needs; copying peers can lead to misaligned spending.

Memory tip: Think "classify before you fortify" - asset categorization answers the threshold question what matters most to the business?, which every other security decision depends on. If you can't prioritize assets, you can't allocate budget wisely.

Topics

#Security Strategy Development#Information Asset Classification#Business Alignment#Resource Optimization

Community Discussion

No community discussion yet for this question.

Full CISM Practice