The security manager reviews recent internal and external developments to decide whether the information security strategy needs revision. Which development is MOST likely to require a strategic change rather than an operational adjustment?
Select an answer to reveal the explanation.
Short Explanation
Ask yourself which item changes what the business is or where it's going. A new regulated business line rewrites your risk landscape, legal obligations and priorities; the rest are just maintenance on the current plan. The trap is the end-of-support notice, which feels urgent but is something you handle inside the program.
Full Explanation
An information security strategy is shaped by internal and external influences that change the organization's objectives, risk profile or obligations. Launching a new line of business in a heavily regulated sector does all three: it introduces new assets and processes, new regulatory requirements, potentially new threat actors and new stakeholder expectations, so the strategy's objectives and priorities must be revisited. A firewall model reaching end of support is a lifecycle event that should be handled through asset management and the program's normal refresh planning; it may need budget, but it does not change strategic direction. A moderate price increase on license renewals is a budgeting matter for the program and is absorbed through normal financial planning or reprioritization. Losing two analysts creates a capacity issue that management addresses through recruitment, cross-training or sourcing, which is operational resource management rather than a change in what the strategy must achieve. Exam caveat: an operational event can become strategic if it signals a systemic issue, such as chronic inability to retain staff, but single occurrences like these normally do not. Operational check: maintain a list of strategic triggers, such as new business lines, mergers, major regulation and significant changes in risk appetite, and review the strategy when one occurs.