Which of the following is MOST important to the effectiveness of an information security steering committee?

Question

Options

• AThe committee uses a risk management framework.
• BThe committee has strong regulatory knowledge.
• CThe committee is comprised of representatives from senior management.
• DThe committee has cross-organizational representation.

• A
  3% (1)
• B
  15% (6)
• C
  5% (2)
• D
  78% (31)

Explanation

Cross-organizational representation (D) is most critical because an information security steering committee derives its effectiveness from its ability to align security decisions with the needs, risks, and priorities of the entire organization - not just IT or compliance. Without representatives from business units like finance, HR, legal, and operations, the committee makes security decisions in a vacuum, leading to policies that don't reflect real business risk.

Why the distractors fall short:

• (A) Risk management framework - A useful tool, but a framework alone doesn't ensure the committee understands the full organizational context it's governing.
• (B) Regulatory knowledge - Important, but compliance expertise can be brought in as needed; the committee's structural composition matters more than any single knowledge area.
• (C) Senior management representation - Executive sponsorship matters, but a committee of only senior managers without cross-functional breadth will still have blind spots across the business.

Memory tip: Think of the steering committee as a "board of directors for security." Just as a corporate board needs diverse representation to govern effectively, a security steering committee needs voices from across the business - not just seniority or technical expertise - to make decisions that actually stick.

No community discussion yet for this question.