An organization is developing an information security program. Which of the following will be MOST helpful in the early stages of this effort?

The correct answer is A. Inventorying the organization's information assets. Inventorying information assets is the foundational first step in building a security program because you cannot protect what you don't know you have. Asset inventory informs risk assessments, threat modeling, and control selection. A BIA (B) depends on knowing which assets and p

Submitted by jaden.t· Apr 18, 2026Information Security Program Development and Management

Question

Options

AInventorying the organization's information assets
BPerforming a business impact analysis (BIA)
CSubscribing to a threat monitoring service
DEstablishing information security awareness training

How the community answered

(37 responses)

A
92% (34)
B
3% (1)
C
5% (2)

Explanation

Inventorying information assets is the foundational first step in building a security program because you cannot protect what you don't know you have. Asset inventory informs risk assessments, threat modeling, and control selection. A BIA (B) depends on knowing which assets and processes exist. Threat monitoring (C) is an operational activity that comes after the program foundation is established. Security awareness training (D) is important but is implemented to protect known assets. Asset inventory provides the baseline from which all subsequent security activities are derived.

Topics

#Information Security Program Development#Asset Management#Foundational Activities#Early Stages

Community Discussion

No community discussion yet for this question.

Full CISM Practice