The security program has more planned activities than available staff can deliver this year, and hiring is frozen. How should the information security manager assign the existing staff?
Select an answer to reveal the explanation.
Short Explanation
When you've got more fires than buckets, you don't split the water evenly; you go for the ones near the fuel tank. Risk priority, agreed with the business, tells you where your people go, not ticket counts or whatever the auditor looked at last.
Full Explanation
With constrained resources, the program must make deliberate choices, and the defensible basis for those choices is risk. Activities that reduce the most significant risks to business objectives should receive staff first, and the priorities should be agreed with business stakeholders so that the resulting residual risk on deferred activities is understood and accepted at the right level. Distributing staff evenly treats a high-risk control gap and a low-value activity as equally important, spreading effort so thinly that critical work may not be completed. Prioritizing whatever auditors examined most recently lets the audit calendar, rather than the organization's risk profile, drive security; audit findings matter, but they are one input to risk prioritization, not a substitute for it. Allocating by ticket volume rewards activities that generate operational noise; high volumes do not indicate high risk and may reflect inefficient processes. Exam caveat: deferring activities creates residual risk that must be communicated and accepted by the appropriate owners, not hidden. Operational check: confirm the resourcing plan ranks activities by risk, shows which are deferred, and records management's acknowledgment of the resulting exposure.