A CISO implements smart cards for credential management, and as a result has reduced costs associated with help desk operations supporting password resets. This demonstrates which of the following principles?

This scenario is a direct example of security alignment to business goals. The CISO implemented a security control (smart cards) that not only improved security posture but also delivered a tangible business benefit: reduced operational costs for the help desk. By demonstrating that security investments can yield a positive return on investment (ROI) and improve business efficiency, the CISO shows that the security program is aligned with and contributes to the broader objectives of the organization, such as cost optimization.

B. While smart cards may help meet certain regulatory requirements, the primary benefit highlighted in the scenario is cost reduction, a business goal.
C. Implementing a new technology increases the program's capabilities, but the key principle demonstrated is the business value of that implementation.
D. Smart cards are a method of policy enforcement, but the outcome described (cost savings) illustrates the strategic alignment with business goals, not just enforcement.

1. Gordon, L. A., & Loeb, M. P. (2002). The economics of information security investment. ACM Transactions on Information and System Security (TISSEC), 5(4), 438-457. https://doi.org/10.1145/581271.581274. This foundational paper discusses how security investments should be treated as business decisions, evaluated on their ability to provide economic value.

2. Anderson, R., & Moore, T. (2006). The economics of information security. Science, 314(5799), 610-613. https://doi.org/10.1126/science.1130992. The paper explores how economic principles, such as demonstrating positive ROI, are crucial for justifying and aligning security measures within a business context.

3. Stanford University. (n.d.). CS 259S: Security and Web Development. Course materials often discuss the business case for security, where initiatives are justified by showing they support business objectives like reducing operational costs or enabling new business.