Lack of User Management Representation

D.

The steering committee controls the execution of the information security strategy, according to the needs of the organization, and decides on the project prioritization and the execution plan.

User management is an important group that should be represented to ensure that the information security plans are aligned with the business needs.

Functional requirements and user training programs are considered to be part of the projects but are not the main risks.

The steering committee does not approve budgets for business units.

The Information Security Steering Committee is a group responsible for overseeing and guiding the information security strategy of an organization. It typically consists of representatives from different departments and functions within the organization. User management representation on the committee is crucial for ensuring that the needs and requirements of users are taken into account in the development and implementation of information security policies and procedures.

The MAIN risk when there is no user management representation on the Information Security Steering Committee is that information security plans may not be aligned with business requirements. This is because users are a critical component of the business and their needs, requirements, and perspectives must be taken into account when developing and implementing security policies and procedures.

Without user management representation on the Information Security Steering Committee, there is a significant risk that security plans will be developed without adequate consideration of the needs and requirements of users. This can result in security measures that are overly restrictive or cumbersome for users, which can lead to frustration and decreased productivity. Additionally, security measures that are not aligned with business requirements may be perceived as unnecessary or burdensome, leading to non-compliance and increased risk of security breaches.

While the other options listed (functional requirements, user training programs, and budgets) are also important considerations for information security, they are not as directly impacted by the absence of user management representation on the Information Security Steering Committee. However, they may indirectly be affected if information security plans are not aligned with business requirements, as this can impact the effectiveness and efficiency of functional requirements, user training programs, and budgets.