CISM · Question #431
An organization plans to offer clients a new service that is subject to regulations. What should the organization do FIRST when developing a security strategy in support of this new service?
The correct answer is B. Perform a gap analysis against the current state. Performing a gap analysis first establishes the current security posture relative to the requirements of the new regulated service. Without knowing what gaps exist, the organization cannot meaningfully establish a compliance program (A), determine which controls are needed (D)…
Question
An organization plans to offer clients a new service that is subject to regulations. What should the organization do FIRST when developing a security strategy in support of this new service?
Options
- AEstablish a compliance program.
- BPerform a gap analysis against the current state
- CAllocate resources to support the service.
- DDetermine security controls for the new service.
How the community answered
(21 responses)- A5% (1)
- B81% (17)
- C10% (2)
- D5% (1)
Explanation
Performing a gap analysis first establishes the current security posture relative to the requirements of the new regulated service. Without knowing what gaps exist, the organization cannot meaningfully establish a compliance program (A), determine which controls are needed (D), or know how much to budget (C). The gap analysis is the foundational discovery step that informs every other element of the security strategy.
Topics
Community Discussion
No community discussion yet for this question.