Exam CISM topic 1 question 230 discussion

I am confused as question says Bottom-UP for which Security awareness is start point while correct answer says creating Steering Committee.

D. Create an information security steering committee. Creating an information security steering committee is crucial because it will establish a structured and top-down approach to information security within the organization. This committee typically includes key stakeholders from various departments and levels of the organization, including senior management. Their primary responsibility is to provide governance, oversight, and strategic direction for information security.

Establishing an information security steering committee is essential for bringing a strategic and top-down approach to information security.

D. Create an information security steering committee. Creating an information security steering committee is crucial because it will establish a structured and top-down approach to information security within the organization. This committee typically includes key stakeholders from various departments and levels of the organization, including senior management. Their primary responsibility is to provide governance, oversight, and strategic direction for information security.

C. Establish an Audit Committee: Establishing an audit committee helps ensure that governance, risk management, and compliance are appropriately addressed at the organizational level. The audit committee typically includes senior management and key stakeholders from different business units, IT, and other relevant departments. It plays a crucial role in overseeing and providing guidance on the organization's information security initiatives, resource allocation, and compliance. By having an audit committee in place, the organization can move towards a more structured and formalized approach to information security, with better tracking of resource allocation, spending, and compliance efforts. The committee can provide a centralized mechanism for monitoring the organization's security posture and risk management practices.

D. Create an information security steering committee.

A. Implement an information security awareness training program.