In a strategy workshop, several executives describe information security as purely an IT department problem and decline to take part in security decisions. Which action is MOST likely to shift ownership toward the business?
Select an answer to reveal the explanation.
Short Explanation
Executives care about what threatens their goals, not about patches and ports. Once you show them security risk as revenue, reputation and regulatory risk, and get one of their own to carry the flag, it stops being 'IT's thing'. Watch out for the reorg answer; moving boxes on the chart doesn't change what's in anyone's head.
Full Explanation
Executive ownership follows relevance. Leaders engage with risks that threaten the objectives they are measured on, so the security manager should translate information security risk into business terms such as revenue, customer trust, regulatory exposure and operational continuity, and then secure an executive sponsor who will champion that view among peers. A sponsor gives the program authority and a business voice, and business framing gives other executives a reason to participate. Moving the security function out of IT may improve independence, but it is a structural change that does not by itself alter how executives perceive their responsibility; they could simply see a different department as owning the problem. Sending more technical reports reinforces the perception that security is technical and is unlikely to be read by an audience that has already disengaged. Mandatory awareness training addresses individual behavior, not ownership of risk decisions, and may be resented as a compliance exercise. Exam caveat: CISM consistently prefers answers that connect security to business objectives and gain senior management commitment over structural or technical fixes. Operational check: confirm that a named executive sponsor exists and that security risk items appear on the agenda of an executive forum.