An information security program is BEST positioned for success when it is closely aligned with:

An information security program's success is fundamentally measured by its ability to support and enable the organization's business objectives. The information security strategy is the formal document that translates business goals into security goals and objectives. Therefore, aligning the security program directly with the security strategy ensures that all activities, resource allocations, and initiatives are purposefully directed toward achieving these business-aligned outcomes. This strategic alignment is the most critical factor for gaining executive support, securing necessary funding, and demonstrating the program's value to the enterprise.

A. Best practices are valuable methods for how to implement security controls, but they do not define the strategic goals or business context for the program.

B. Recognized industry frameworks provide structure and guidance; they are tools used to implement the strategy, not the primary objective to align with for success.

C. Information security policies are high-level rules derived from the strategy. The program implements these policies, but its overarching alignment must be with the strategy itself.

1. ISACA. (2016). CISM Review Manual

15th Edition. Domain 1: Information Security Governance

Section 1.2.2 Strategic Alignment

p. 28. The manual states

"The information security program is the vehicle for implementing the strategy

" which establishes the direct and essential link between the two for achieving success.

2. von Solms

S. H.

& von Solms

R. (2004). The 10 deadly sins of information security management. Computers & Security

23(5)

371-376. https://doi.org/10.1016/j.cose.2004.05.002. The authors identify the failure to align security with business objectives as a primary reason for failure

underscoring that the program must be driven by the business-aligned strategy.

3. Abu-Musa

A. A. (2009). Information security governance in Saudi organizations: an empirical study. Information Management & Computer Security

17(3)

226-276. https://doi.org/10.1108/09685220910982640. This study reinforces that effective information security governance

which directs the security program

is contingent upon the strategic alignment of security with the organization's mission and objectives.