Which of the following BEST enables an information security manager to obtain organizational support for the implementation of security controls?

Question

Options

• AConducting periodic vulnerability assessments
• BDefining the organization's risk management framework
• CEstablishing effective stakeholder relationships
• DCommunicating business impact analysis (BIA) results

• A
  5% (2)
• B
  11% (4)
• C
  81% (30)
• D
  3% (1)

Explanation

Establishing effective stakeholder relationships (C) is the best answer because organizational support ultimately comes from people - executives, department heads, and other decision-makers who must champion or fund security initiatives. Without trust and buy-in from stakeholders, even the most technically sound security controls will face resistance or go unfunded.

• A (Vulnerability assessments) identifies weaknesses but doesn't directly build the organizational will to act on them - it's an input to decision-making, not a mechanism for gaining support.
• B (Risk management framework) provides structure for handling risk, but defining a framework is a technical/governance activity, not a relationship-building one; frameworks don't automatically generate buy-in.
• D (BIA results) communicates the business impact of disruptions and is useful context, but it's a one-way communication artifact - it informs stakeholders rather than engaging them as partners.

Memory tip: Think of it as the "politics before paperwork" principle - in security management, your ability to get things done depends more on who trusts you than on what documents you produce. Relationships open doors; reports just knock on them.

No community discussion yet for this question.