The board approved a three-year information security strategy, but no executive has taken ownership of it, and most initiatives have stalled waiting for decisions from business units. What is MOST likely to restore momentum?
Select an answer to reveal the explanation.
Short Explanation
Board approval is the starting gun, not the engine. Initiatives that need business units to make decisions will sit forever unless someone with executive clout is pushing them along, and that's your sponsor. More reports or more staff won't help when what's missing is someone who can tell the business 'this matters, decide now'.
Full Explanation
A security strategy depends on decisions and resources owned across the business, so it requires ongoing commitment from senior leadership, not just one-time approval. When initiatives stall waiting for business units, the missing element is executive authority to drive those decisions. An active senior executive sponsor who owns the strategy's business outcomes can secure priority, resolve conflicts between units and hold peers accountable for their contributions. Breaking the strategy into pieces the security team can deliver alone avoids the dependency but abandons the cross-functional elements that are usually the point of a strategy; security cannot unilaterally change business processes. Reporting delays to the steering committee more often makes the problem visible, yet visibility without an owner who will act tends to produce more discussion rather than decisions. Requesting more staff and budget misdiagnoses the constraint, because the initiatives are not stalled for lack of security capacity but for lack of business decisions. Exam caveat: the board's approval establishes direction, but the CISM view is that gaining ongoing commitment from senior leadership is a continuing task for the security manager. Operational check: confirm a named executive sponsor, a regular sponsor review of stalled decisions, and decision deadlines recorded for each dependent business unit.