A security program manager receives audit findings indicating that security controls are not consistently applied across business units. The root cause is that each unit interprets the corporate security policy differently. Which corrective action BEST addresses this systemic gap?

Question

Accepted Answer

B. Develop unit-specific standards that translate policy requirements into measurable control baselines. When policy is interpreted inconsistently, the gap is between the high-level policy and the operational controls. Standards translate policy intent into specific, measurable, and auditable control requirements that each business unit must meet consistently. This is consistent with the CAS-005 V5 objectives on security program documentation, which distinguish the role of policies, standards, and procedures.

A security program manager receives audit findings indicating that security controls are not consistently applied across business units. The root cause is that each unit interprets the corporate security policy differently. Which corrective action BEST addresses this systemic gap?

Related Questions

Discussion