Newly appointed board members ask the security manager what their role in information security should be. Which description is MOST appropriate?
Select an answer to reveal the explanation.
Short Explanation
Think of the board as the people who set the destination and check that the car is still headed there, not the ones holding the steering wheel. They give direction, decide how much risk is OK, and make management answer for results. If you see an answer dragging the board into operations or audit work, that's the trap.
Full Explanation
Information security governance distinguishes between the governing body and management. The board's role is to set strategic direction, approve or endorse the risk appetite within which the organization operates, ensure adequate resources and structures exist, and oversee management's performance in managing information risk, holding executives accountable for results. Approving firewall changes or technical designs drags the board into operational decisions that require specialist knowledge, consume its limited time and blur accountability, because a board that makes operational choices cannot objectively oversee them. Running the security program day to day is management's role; the steering committee is a management body that executes within the direction the board sets. Performing control effectiveness assessments is an assurance activity normally conducted by internal audit or other independent assurers reporting to the board, typically through an audit committee; the board relies on that assurance rather than replacing it. Exam caveat: board members may sit on committees with deeper engagement, such as an audit or risk committee, but the role remains oversight. Operational check: confirm the board receives periodic reporting on information risk against appetite, approves the security strategy, and records its challenge of management in meeting minutes.