Midway through a three-year security strategy, the company announces a cloud-first transformation that will move most business applications to external providers within two years. What is the BEST action for the security manager?
Select an answer to reveal the explanation.
Short Explanation
Your strategy is a map, and the business just changed destinations. Sticking to the old route until the scheduled review means you'll be guarding buildings nobody's using. Realign now; the trap is the 'just bolt on some cloud tools' answer, which treats a change of direction like a shopping trip.
Full Explanation
An information security strategy is valid only as long as it remains aligned with the business strategy it supports. A cloud-first transformation changes where data resides, who operates key controls, which third parties the organization depends on and what risks are most significant, so the security manager should reassess the strategy and realign its objectives, priorities and roadmap with the new direction. Continuing unchanged until a scheduled review would leave security investing in a target state that no longer matches the business, potentially for more than a year, while the migrations proceed without adequate security planning. Asking management to pause the transformation inverts the relationship between security and the business; security enables business objectives at acceptable risk, and blocking a strategic decision is not the security manager's role. Adding cloud tools to the existing roadmap without revisiting objectives treats a strategic shift as a tooling gap and ignores governance changes such as shared responsibility, third-party risk and architecture. Exam caveat: strategies should have scheduled reviews, but significant changes in business direction are triggers for out-of-cycle review. Operational check: confirm the revised strategy maps each objective to the cloud transformation's goals and that the roadmap has been re-approved by the sponsor.