Which of the following would provide the BEST justification for the implementation of a new security solution?

Question

Options

• AInternal audit results
• BBusiness case
• CIncident management report
• DRisk analysis report

• A
  12% (6)
• B
  80% (40)
• C
  2% (1)
• D
  6% (3)

Explanation

A business case provides the BEST justification for implementing a new security solution because it translates technical needs into organizational language - covering costs, benefits, ROI, risk reduction, and strategic alignment - giving decision-makers everything they need to approve and fund the initiative.

Why the distractors fall short:

• A (Internal audit results) identify gaps and deficiencies, but they describe what's wrong, not why the solution is worth investing in.
• C (Incident management report) documents past incidents, which may support the argument but is reactive and narrowly scoped - it's evidence, not a justification framework.
• D (Risk analysis report) quantifies threats and vulnerabilities, and while it's a valuable input to a business case, it alone doesn't address cost, ROI, or organizational benefit.

Memory tip: Think of the business case as the "sales pitch" to leadership - it wraps risk, cost, and value into one document. The other options are inputs to that pitch, not the pitch itself. If something sounds like a report that already exists, it's probably a distractor; the business case is something you build to justify action.

No community discussion yet for this question.