Free readiness test
ISACA CISM®: 40 free scenario questions
Prepare for the ISACA CISM exam across all four domains — security governance, risk management, the security programme and incident management.
Reviewed by cyber security professionals with 25+ years of experience each.
Sign up free to startScenario
You have just joined a fast-growing online lending company as its first information security manager. The board's strategy is to expand into three new countries within 18 months, partner with banks through open APIs and launch an AI-based credit scoring engine. The previous IT manager left behind a security 'strategy' consisting of a list of tools to buy — a new firewall, an endpoint product and a SIEM — with a ₹6 crore budget request. The CEO asks you to present a security strategy at the next board meeting in four weeks. Business leaders view security as a blocker that slows product launches, and a partner bank has just asked for evidence of the company's security programme before signing an API agreement. The CFO has also hinted that the security budget will be cut if it cannot be linked to revenue.
What should the information security manager do FIRST?
- APresent the existing tool list to the board with a revised budget.
- BBenchmark security spending against competitors and request a similar budget.
- CImplement quick technical wins to demonstrate value before engaging the board.
- DUnderstand business objectives first, then build a linked roadmap.