A business unit has updated its long-term business plan to include the upgrading of information management systems to increase productivity. To support this initiative, what should be the PRIMARY basi

The correct answer is A. The business strategy. Information security strategy exists to enable and protect the business; therefore, it must be derived from and aligned with the organization's business strategy. When the business plan changes-such as upgrading information management systems-the security strategy must be updated

Submitted by renata2k· Apr 18, 2026Information Security Governance

Question

A business unit has updated its long-term business plan to include the upgrading of information management systems to increase productivity. To support this initiative, what should be the PRIMARY basis for updating the corresponding information security strategy?

Options

AThe business strategy
BCapability maturity model
CThe information security framework
DProductivity key performance indicators (KPIs)

How the community answered

(17 responses)

A
71% (12)
B
6% (1)
C
6% (1)
D
18% (3)

Explanation

Information security strategy exists to enable and protect the business; therefore, it must be derived from and aligned with the organization's business strategy. When the business plan changes-such as upgrading information management systems-the security strategy must be updated to address the new risks, requirements, and objectives that stem from that business direction. A capability maturity model (B) is a tool for measuring and improving process maturity, not a strategic driver. An information security framework (C) provides structural guidance but is not the primary input for strategic updates driven by business change. Productivity KPIs (D) are operational metrics that measure outcomes, not strategic direction.

Topics

#Business Alignment#Security Strategy#Governance Principles#Strategic Planning

Community Discussion

No community discussion yet for this question.

Full CISM Practice