A security manager has been asked to develop a new information security strategy for the organization. What should the security manager do FIRST?
Select an answer to reveal the explanation.
Short Explanation
A security strategy that doesn't know where the business is going is just a shopping list. You start with what the business is trying to achieve, then work out how security helps get it there. Every other answer here is a later step dressed up as a starting point.
Full Explanation
An information security strategy exists to support the organization's business objectives, so developing one starts with understanding those objectives: where the business is going, what it values, what constraints it operates under and how much risk leadership is willing to accept. Only then can the security manager define a desired state and measure the current state against it. A technical vulnerability assessment describes part of the current state, but performed first it anchors the strategy in technical findings rather than business needs and may consume effort on systems that matter little to objectives. Selecting a framework is a useful structuring decision, but the choice should follow from understanding the business, its regulatory environment and its goals; picking first risks forcing the strategy into a template that does not fit. Inventorying tools focuses on technology and assumes the gaps that matter are tool gaps, which is a solution-first approach. Exam caveat: on CISM, the first step in strategy development is almost always alignment with business objectives, with current-state assessment and gap analysis following. Operational check: confirm the draft strategy traces each security objective to a stated business objective and that business leaders have reviewed that mapping.