After a competitor received public praise for its security program, executives ask the information security manager to copy that program's structure and priorities. What should the information security manager recommend?
Select an answer to reveal the explanation.
Short Explanation
Your neighbor's diet might be great, but it's built for their body, not yours. Benchmarking is useful as a comparison, while your own risks and goals set your program, so you learn from them without photocopying them.
Full Explanation
Benchmarking against peers can reveal practices, investment levels and capabilities worth considering, and it helps executives understand where the organization stands. However, a security program must be driven by the organization's own business objectives, risk profile, regulatory obligations and risk appetite, which differ even among firms in the same industry. The information security manager should therefore use the competitor's program as an input to identify possible gaps or improvements, while basing requirements and priorities on the organization's own risk assessment and strategy. Adopting the peer's program in full assumes identical circumstances; differences in business model, technology, geography and risk tolerance mean the copy would misallocate effort and may miss the organization's own key risks. Rejecting benchmarking entirely discards a legitimate source of insight; the problem lies in substituting it for analysis, not in using it. Adopting the peer's budget and letting the team allocate it detaches spending from business needs and governance, and the peer's spending reflects its circumstances. Exam caveat: public praise reflects visible features and may not indicate effectiveness. Operational check: confirm any change adopted from the benchmark is traced to an identified risk or objective in the organization's own strategy.