Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Because C is too narrow in scope. An information security strategy must align with business objectives, organizational governance, regulatory mandates, and operational processes, not just IT or technology risks.
Shows current capabilities, desired capabilities, and the gaps the strategy needs to address. C is simply too narrow.
A gap analysis shows you the difference between your current security state and your desired target state. That comparison is the most essential input for building a strategy because a strategy by definition is a plan to get from where you are to where you need to be. Without knowing the gap, you cannot define meaningful strategic objectives, priorities or roadmap. ISACA frames strategy development as fundamentally requiring a current state assessment the gap analysis provides exactly that foundation.