Which of the following BEST demonstrates senior management support for the information security program?

Question

Options

• AEnforcing security policies and procedures
• BRequiring organization-wide security awareness training
• CProviding adequate security resources and funding
• DSoliciting feedback from business functions regarding security needs

• C
  95% (19)
• D
  5% (1)

Explanation

Providing adequate security resources and funding (C) is the clearest demonstration of senior management support because it reflects a tangible, executive-level commitment - only senior leadership controls budgets and resource allocation. Without funding and staffing, no security program can function regardless of policies or intentions.

Why the distractors fall short:

• A (Enforcing policies) is typically an operational/managerial responsibility, not a senior leadership activity - it happens after management sets direction.
• B (Requiring security awareness training) shows support but is more of a directive action that middle management can execute; it doesn't reflect the financial backing that only executives control.
• D (Soliciting feedback) is a good governance practice but is consultative in nature - gathering input doesn't demonstrate commitment the way resource allocation does.

Memory tip: Think of senior management support in terms of what only an executive can do. Anyone can mandate training or enforce rules, but writing the check and approving headcount requires authority at the top - "show me the money" = senior management support.

No community discussion yet for this question.