A new information security manager finds that the organization tends to use short-term solutions to address problems. Resource allocation and spending are not effectively tracked, and there is no…

Implementing awareness training is important but addresses user behavior rather than the systemic lack of strategic oversight and resource allocation.

Conducting a threat analysis is an operational task that provides input for risk management but does not establish the necessary top-down governance structure.

Establishing an audit committee primarily focuses on oversight of financial reporting and internal controls, not directly on the strategic direction and resource allocation of information security.

An information security steering committee, composed of senior management from various departments, provides strategic direction, ensures alignment with business goals, and enables top-down enforcement of security initiatives, which is crucial for moving away from a reactive, bottom-up approach. This committee establishes governance, allocates resources effectively, and oversees compliance, addressing all the identified problems structurally.