Business units view the security team as an obstacle and increasingly launch projects without involving it, discovering security requirements only late in delivery. Which action is MOST likely to build partnership and bring security in earlier?
Select an answer to reveal the explanation.
Short Explanation
If people are walking around your front door, building a bigger door won't help; you need someone already inside their house. Security champions are your friendly locals who raise security early, in the business's own language. Notice that the other three answers are all about more control, which is exactly why they're routing around you.
Full Explanation
When business units avoid the security function, the root problem is a relationship in which security is perceived as a gatekeeper rather than a partner. Embedding security champions in business units, people from the business who receive additional training and act as a link to the security team, brings security considerations into planning when they are cheapest to address and builds trust in both directions. A mandatory approval step before funding is a stronger gate; applied to a group that already sees security as an obstacle, it is likely to increase friction and encourage further workarounds. Expanded detection and reporting of unsanctioned projects is a policing approach that may identify the symptom but deepens the adversarial dynamic. A stricter standard with listed penalties relies on deterrence and does nothing to make early involvement easier or more valuable to the business. Exam caveat: gates and monitoring still have a place for high-risk activities, but CISM favors collaborative, culture-building measures when the stated problem is perception and engagement. Operational check: track the stage at which security is first engaged on new projects and the number of late-stage security findings before and after champions are appointed.