A newly hired information security manager finds that the security program was started two years ago without a charter, defined scope or documented link to the information security strategy. Teams disagree about which activities belong to the program. What should be done FIRST?
Select an answer to reveal the explanation.
Short Explanation
You can't settle an argument about what's in the house if nobody's drawn the property line. A charter, tied to the strategy and signed by a sponsor, is that property line, and you draw it before you start counting tools.
Full Explanation
A program charter establishes why the program exists, what it covers, who has authority over it and which strategic objectives it serves. Without one, teams disagree about scope, priorities shift with whoever is most persuasive, and the program cannot show that it supports the information security strategy. Developing a charter aligned with the strategy and obtaining approval from an executive sponsor provides the mandate, boundaries and objectives against which all later decisions about resources, tools and projects are made. Inventorying tools and assigning them to teams organizes existing assets but cannot resolve which activities belong in the program; it starts from technology rather than from objectives. A vulnerability assessment produces technical findings useful for prioritizing remediation, yet it does not define the program's purpose or scope and represents only one input to it. Benchmarking the budget against peers gives a reference point for resourcing but is premature when the program's objectives and scope are undefined, and peer spending does not reflect this organization's risks. Exam caveat: these other activities may all follow, but they depend on the charter. Operational check: confirm the approved charter names the sponsor, scope boundaries, authority and the strategic objectives each program area supports.