Which of the following provides the BEST evidence that the information security program is aligned to the business strategy?

Question

Options

• AInformation security initiatives are directly correlated to business processes.
• BThe information security program requires well-defined risk tolerance.
• CThe information security program meets the chief information security officer's (CISO)
• DThe information security team is able to provide key performance indicators (KPIs) to senior

• A
  79% (30)
• B
  3% (1)
• C
  11% (4)
• D
  8% (3)

Explanation

Alignment means security activities exist to support and enable the business - not the other way around. When security initiatives can be traced directly to specific business processes (e.g., securing a payment workflow, protecting customer data in a revenue-generating application), it demonstrates that security priorities were derived from business priorities. This traceability is concrete evidence of alignment. Risk tolerance is a governance input, not evidence of alignment. Meeting the CISO's requirements reflects internal security standards, not business alignment. KPIs measure performance and efficiency, but high KPIs do not prove the program is working on the right things from a business perspective.

No community discussion yet for this question.