Strategic Plan for Information Security

D.

Any planning for information security should be properly aligned with the needs of the business.

Technology should not come before the needs of the business, nor should planning be done on an artificial timetable that ignores business needs.

The correct answer is D, the timeline for the information security strategic plan should be aligned with the business strategy.

Explanation:

Information security is a critical aspect of any business, and an information security manager is responsible for ensuring the confidentiality, integrity, and availability of the organization's information assets. Developing a strategic plan for information security is an essential step in achieving this goal, and the timeline for the plan is an important consideration.

Option A: The information security strategic plan should be aligned with the IT strategic plan to ensure that the organization's IT infrastructure and resources are appropriately secured. However, the IT strategic plan may not necessarily align with the overall business strategy, which could lead to misaligned security priorities.

Option B: While the current rate of technological change can impact the security landscape, it is not a suitable timeline for an information security strategic plan. Technological change can occur rapidly, and a plan based on current rates would likely become outdated quickly.

Option C: A three-to-five-year timeline for both hardware and software is a common approach for technology planning. However, this timeline does not necessarily align with the business strategy and may not take into account the specific security risks and threats facing the organization.

Option D: The most appropriate timeline for an information security strategic plan is one that is aligned with the business strategy. The security plan should support the overall goals and objectives of the organization and take into account the specific risks and threats facing the business. A timeline that aligns with the business strategy ensures that the security plan is appropriately prioritized and supports the organization's overall success.