According to ISO 27001, of the steps for establishing an Information Security Governance program listed below, which comes first?

According to the ISO/IEC 27001 standard, the establishment of an Information Security Policy is a foundational step driven by top management. Clause 5.2, "Policy," requires leadership to create a policy that defines the overall direction and objectives for information security. This policy provides the authority and framework for all subsequent Information Security Management System (ISMS) activities, including risk assessment (Clause 6.1.2), risk treatment (Clause 6.1.3), and resource allocation (Clause 7.1).

A: Identifying threats and risks is part of the risk assessment process (Clause 6.1.2), which is performed within the framework established by the policy. B: Deciding how to manage risk (risk treatment, Clause 6.1.3) is a subsequent step that follows the completion of the risk assessment. C: Defining the budget is part of providing resources (Clause 7.1), an activity that supports the ISMS as directed by the policy and plans.

1. ISO/IEC 27001:2013, Information technology — Security techniques — Information security management systems — Requirements. Clause 5.2, "Policy," and Clause 6.1, "Actions to address risks and opportunities."

2. Calder, A., & Watkins, S. (2019). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page. Chapter 11, "Clause 5: Leadership," emphasizes that establishing the policy is a key leadership responsibility.