Which of the following is the BEST source of information to support an organization's information security vision and strategy?

The correct answer is C. Enterprise information security architecture. The Enterprise Information Security Architecture (EISA) provides a structured, holistic model of the organization's current security capabilities, technologies, and gaps, mapped against business objectives. This makes it the ideal foundation for defining a security vision…

Submitted by zhang_li· Apr 18, 2026Information Security Governance

Question

Options

AGovernance policies
BMetrics dashboard
CEnterprise information security architecture
DCapability maturity model

How the community answered

(36 responses)

A
3% (1)
B
3% (1)
C
89% (32)
D
6% (2)

Explanation

The Enterprise Information Security Architecture (EISA) provides a structured, holistic model of the organization's current security capabilities, technologies, and gaps, mapped against business objectives. This makes it the ideal foundation for defining a security vision (where we want to be) and strategy (how we get there). Governance policies describe rules and mandates but do not describe the current state or future direction of security capabilities. A metrics dashboard shows point-in-time performance data, not a strategic roadmap. A capability maturity model measures how mature processes are, which is useful for gap analysis but is one input into strategy, not the primary source.

Topics

#Information Security Architecture#Security Strategy#Governance Framework#Strategic Alignment

Community Discussion

No community discussion yet for this question.

Full CISM Practice