A business unit has repeatedly declined to implement controls required by the approved information security standard, citing productivity. Discussions with the unit's manager have not resolved the issue. What should the information security manager do NEXT?
Select an answer to reveal the explanation.
Short Explanation
When talking it out at your level hasn't worked, you take it up the chain you were given for exactly this. The steering committee can weigh productivity against risk and make a call that sticks. Going around the business with admin rights or caving with a permanent exception are both shortcuts that skip governance.
Full Explanation
Governance structures exist so that disagreements between security requirements and business priorities are resolved by people with the authority to make risk decisions. When direct discussion has failed, the security manager should escalate through the defined path, typically a security steering committee or equivalent, presenting the requirement, the business unit's concerns and the resulting risk. That body can direct compliance, approve a time-limited exception with compensating controls or adjust the standard. Implementing controls directly using security team access overrides the business owner, damages trust and exceeds the security manager's authority, even if the control itself is sound. A permanent exception granted by the security manager is a risk acceptance decision that the manager is not entitled to make, and permanence removes any pressure to revisit it. Reporting the manager to human resources treats a legitimate business disagreement as misconduct and bypasses the governance process designed for it. Exam caveat: escalation is not a complaint; it should be factual, show the business impact and offer options. Operational check: confirm the escalation records the requirement, the risk rating, the options considered and the decision maker, and that the outcome is tracked in the risk register.