Which of the following is a PRIMARY reason for senior management to review reports on information security?

Question

Options

• ATo ensure adequate security resources are available
• BTo ensure security risk is managed cost-effectively
• CTo confirm security audits are regularly performed
• DTo assess the effectiveness of the security program

• A
  5% (1)
• B
  10% (2)
• C
  15% (3)
• D
  70% (14)

Explanation

Senior management's primary reason for reviewing security reports is to assess the effectiveness of the security program (D) - they need oversight at a strategic level to determine whether security investments and controls are actually working toward business objectives. Options A, B, and C describe valid outcomes or byproducts of security reporting, but they are narrower in scope: ensuring resources (A) is an input concern, cost-effectiveness (B) is a financial sub-goal, and confirming audits are performed (C) is a compliance/operational check - none of these represent the overarching governance purpose. Senior management's role is not to manage day-to-day operations but to exercise governance, which means evaluating overall program performance and alignment with organizational risk tolerance.

Memory tip: Think of it this way - management governs, they don't operate. The word "effectiveness" maps directly to governance oversight, while the distractors all describe specific operational or financial concerns that fall under management's response to what they learn, not why they review reports in the first place.

No community discussion yet for this question.