CISM · Question #232
Which of the following should be senior management's PRIMARY role with regard to information security policies?
The correct answer is D. Approval. Senior management's primary accountability is governance - setting direction and authorizing policies, not writing or implementing them. By formally approving security policies, senior management signals organizational commitment, grants authority for enforcement, and accepts…
Question
Which of the following should be senior management's PRIMARY role with regard to information security policies?
Options
- ADevelopment
- BImplementation
- CValidation
- DApproval
How the community answered
(27 responses)- A4% (1)
- C4% (1)
- D93% (25)
Explanation
Senior management's primary accountability is governance - setting direction and authorizing policies, not writing or implementing them. By formally approving security policies, senior management signals organizational commitment, grants authority for enforcement, and accepts accountability. Policy development (A) is typically done by security professionals. Implementation (B) is carried out by operational staff and IT teams. Validation (C) may be delegated to audit or compliance functions. Senior management's unique and non-delegable role is approval, which gives policies their organizational authority and enforceability.
Topics
Community Discussion
No community discussion yet for this question.