Exam CISM topic 1 question 219 discussion

Option C- Option A, which suggests that the steering committee provides guidance and dispute resolution, can also be important in addressing conflicts between performance pressures on IT and information security controls. However, it is not the MOST important action in this context. While the steering committee can play a role in providing guidance and resolving disputes, it is ultimately more effective to establish a foundation where IT policies and procedures are better aligned to security policies.

C. IT policies and procedures are better aligned to security policies: This is the most effective approach because it addresses the root cause of the conflict. By integrating security requirements directly into IT processes and procedures, organizations create a framework where performance and security goals are not in opposition but are instead achieved together. This proactive approach prevents conflicts from arising in the first place, leading to smoother operations and greater security compliance.

C seems reasonable

C is a better choice than A because: If there are conflicts between IT and Security, it shows that policies and procedures are not aligned. Of course the steering committee can provide further guidance (answer A), but that does not tackle the root cause of the problem. Hence, answer C is more appropriate in this case.

B IS THE BEST

C. IT policies and procedures are better aligned to security policies

So is the answer C or A?

C. IT policies and procedures are better aligned to security policies. Makes more sense to me.

A. the steering committee provides guidance and dispute resolution.

important aspect is that the steering committee provides guidance and dispute resolution, it is important to have a clear and robust governance structure in place that can support IT and security teams in managing these conflicts.