Business unit leaders complain that security program initiatives do not reflect their priorities and often disrupt their projects. What should the information security manager do to address this on an ongoing basis?
Select an answer to reveal the explanation.
Short Explanation
If your customers keep saying you're not listening, the fix is to build in listening, not to explain louder. A regular feedback loop lets you adjust the program while it's still running. Telling them security knows best is the classic trap; CISM wants the program aligned with the business it protects.
Full Explanation
An information security program exists to support business objectives, so stakeholder feedback is a key input to its continuous improvement. A regular mechanism, such as periodic reviews with business leaders, steering committee agenda items or structured surveys, captures where initiatives conflict with business priorities, and the program can then adjust sequencing, scope or approach while still managing risk within appetite. This also builds the relationships that make future controls easier to adopt. Telling leaders that priorities come from the security team and threat intelligence alone reinforces the perception of a program detached from business needs, and it ignores the governance principle that security is aligned to business strategy. Pausing every initiative that touches business projects is a disproportionate reaction that could leave significant risks untreated. Making each unit fund its own initiatives fragments the program, undermines consistency and can leave enterprise-level risks without an owner or budget. Exam caveat: feedback informs priorities, but it does not override risk; some controls will remain required even when unpopular. Operational check: confirm feedback is collected on a set schedule, logged with the resulting decision, and reported back to stakeholders so they can see it was acted on.