QuestionQ10Verified/Security and Risk ManagementCopy linkReport a problemAsk AstroTutorSave questionWhen is an organization required to review its information security strategic plan?AWhenever there are major changes to the businessBQuarterly, when the organization's strategic plan is updatedCEvery three years, when the organization's strategic plan is updatedDWhenever there are significant changes to a major applicationShow AnswerAnswerExplanationThe information security strategy is business-aligned; major changes to the business can change strategic objectives, risk exposure, regulatory obligations, and resource priorities. The plan must therefore be reviewed whenever such changes occur to preserve alignment. ISACA notes that shifts in business strategy and direction can require changes to the cybersecurity strategy.Learn moreISACA: Developing a Cyberstrategy With the Seven Pillars of CyberresilienceShow comments8Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion