Which of the following BEST enables an organization to meet information security-related compliance requirements?

The correct answer is B. Considering compliance requirements when developing the organization's security program. Embedding compliance requirements into the design and development of the security program ensures they are addressed proactively and systematically across the organization, rather than treated as an afterthought. Putting compliance on board meeting agendas (A) promotes…

Submitted by satoshi_tk· Apr 18, 2026Information Security Program Development and Management

Question

Options

AIncluding compliance requirements as an agenda item in senior management and board meetings
BConsidering compliance requirements when developing the organization's security program
CAssigning accountability for security compliance to the chief information security officer (CISO)
DEnsuring the internal audit function includes compliance audits in the annual security audit plan

How the community answered

(40 responses)

A
8% (3)
B
78% (31)
C
13% (5)
D
3% (1)

Explanation

Embedding compliance requirements into the design and development of the security program ensures they are addressed proactively and systematically across the organization, rather than treated as an afterthought. Putting compliance on board meeting agendas (A) promotes visibility but not implementation. Assigning accountability to the CISO (C) creates ownership but does not guarantee requirements are actually built into controls and processes. Including compliance audits in the audit plan (D) checks for compliance after the fact but does not drive its integration into operations. Building compliance into the security program from the start is the most effective and sustainable approach.

Topics

#Information security compliance#Security program development#Regulatory requirements#Proactive security

Community Discussion

No community discussion yet for this question.

Full CISM Practice