An organization is forming an information security steering committee to set priorities and resolve cross-functional issues. Which membership would make the committee MOST effective?
Select an answer to reveal the explanation.
Short Explanation
A steering committee steers the business, so the business has to be in the driver's seat. Pack it with only techies and you'll get technical priorities; pack it with auditors and you've wrecked their independence. You want senior people from every function that owns or is affected by security risk.
Full Explanation
An information security steering committee exists to align security priorities with business objectives, allocate resources, and resolve issues that cross organizational boundaries. To do that it needs senior representatives of the functions that own risk and are affected by security decisions: business unit leaders, IT, legal, risk management and the information security function, often with human resources and compliance as well. A committee made up only of IT managers and security architects lacks business perspective and authority over business processes, so its decisions tend to be technically driven and poorly adopted. Including internal and external auditors as decision-making members compromises their independence; auditors can attend as observers or advisors, but they should not help make the decisions they later assess. A board-only committee would blur the distinction between oversight and management; the board sets direction and oversees, while management executes through bodies such as this committee. Exam caveat: committee size should remain workable, and members must be senior enough to commit their functions. Operational check: review the committee charter to confirm business representation, decision rights, meeting frequency and reporting to executive management or the board.