While developing the information security strategy, the security manager has documented the current state of security and now needs to define the desired state for a gap analysis. How should the desired state be determined?
Select an answer to reveal the explanation.
Short Explanation
The desired state is the 'where are we going' half of the map, and the business picks the destination. You work it out from what the business needs and how much risk leadership will accept. The trap is assuming 'maximum maturity everywhere' is the goal; that's an expensive road to nowhere in particular.
Full Explanation
A gap analysis compares where security is today with where it needs to be, and the desired state must reflect what the organization actually requires. That target is derived from business objectives, legal and contractual obligations and the risk appetite approved by senior management, so that each element of the target state has a business justification and represents an acceptable level of risk rather than an abstract ideal. Adopting the highest maturity level everywhere ignores that different processes carry different risks; pursuing maximum maturity uniformly wastes resources on low-risk areas and may still underinvest in critical ones. Copying what peers report is unreliable and context-blind; peers differ in risk appetite, regulatory exposure and business model, and self-reported control sets reveal little about effectiveness. Listing controls to remediate every current-state finding defines the target by the existing problems, which makes the desired state reactive and may omit requirements no current finding reveals. Exam caveat: maturity models and benchmarks can help express or calibrate the desired state, but they are tools for describing it, not the basis for choosing it. Operational check: confirm each desired-state attribute traces to a business requirement or appetite statement and that senior management has endorsed the target.