An organization adopted a well-known security governance framework exactly as published. A year later, teams are overwhelmed by requirements that do not fit the business, and many controls address risks the organization does not face. What should the security manager do?
Select an answer to reveal the explanation.
Short Explanation
A framework is like an off-the-rack suit; it's a great starting point, but you tailor it so it actually fits. You keep what addresses your real risks, adjust or drop what doesn't, and write down why. The traps are the two extremes: wearing it baggy forever or throwing it out entirely.
Full Explanation
Governance and control frameworks are designed to be broadly applicable, which means no single organization needs every element in the same form. Effective adoption involves tailoring the framework to the organization's risks, size, regulatory obligations and business context: retaining what addresses relevant risks, scaling requirements to the organization, and documenting the rationale for exclusions or modifications so that decisions are transparent and reviewable. Continuing full adoption keeps imposing effort on irrelevant requirements, consumes resources that should address real risks and erodes support for the security program. Abandoning the framework discards a proven structure, common language and external credibility; building a control set from scratch is costly and likely to leave gaps the framework would have covered. Implementing only the requirements easiest to evidence optimizes for audit appearances rather than risk reduction and may omit the controls that matter most. Exam caveat: where a framework or standard is mandated by regulation or contract, tailoring is limited to what the mandate allows, and certification schemes may require formal justification for any excluded controls. Operational check: produce a documented applicability decision for each framework element, linked to the risk assessment, and have it approved by the steering committee.