A draft information security strategy lists several items in a single table. Which item is a constraint on the strategy rather than an objective of it?
Select an answer to reveal the explanation.
Short Explanation
Objectives are where you're trying to get; constraints are the walls of the hallway you have to walk down. A capped budget doesn't tell you where to go, it limits how you get there. If you mix the two up, your strategy ends up 'aiming' at things you were only supposed to work within.
Full Explanation
A well-structured strategy distinguishes between objectives, the outcomes it seeks to achieve, and constraints, the conditions that limit how those outcomes can be pursued. Common constraints include budget limits, legal and regulatory boundaries, organizational culture, available skills, time and technology dependencies. A security budget fixed for the strategy period is a constraint: it sets the resources within which objectives must be delivered and shapes prioritization, but it is not an outcome the organization is trying to reach. Reducing detection time for incidents affecting customer services is an objective, a measurable improvement the strategy aims to deliver. Supporting secure expansion into online payments is an objective tied directly to a business goal, which is exactly how CISM expects strategy objectives to be expressed. Achieving compliance with data protection obligations in new markets is also an objective; legal requirements can impose constraints, but here the item is phrased as an outcome to be achieved. Exam caveat: the same subject can appear as either depending on wording; a regulation that limits where data may be stored acts as a constraint, while becoming compliant is an objective. Operational check: review the strategy document to confirm objectives and constraints are listed separately and that each objective is feasible within the stated constraints.