Which of the following should have the MOST influence on the development of information security policies?

In the ISACA CISM framework, information security exists fundamentally to support, enable, and protect the organization's business objectives. Therefore, the overarching business strategy must have the most significant influence on the development of information security policies. Aligning security policies directly with the business strategy ensures that security initiatives facilitate core business operations, comply with relevant organizational goals, and receive appropriate executive support and funding. If security policies are developed in isolation from the business strategy, they risk becoming misaligned with organizational priorities, potentially acting as a barrier to operational success and failing to deliver tangible value to the enterprise.

B. While past and current threats inform specific risk assessments and technical controls, they do not dictate the overarching security policies, which must be business-driven.
C. An IT security framework provides a structural methodology for implementing security, but the framework itself must be selected and tailored based on the business strategy.
D. Industry standards guide best practices and compliance requirements, but they must be applied strictly within the context and boundaries of the organization's specific business strategy.

1. ISACA. (2016). CISM Review Manual, 15th Edition. Chapter 1: Information Security Governance, Section 1.2 (Business Model for Information Security).

2. ISACA. (2016). CISM Review Manual, 15th Edition. Chapter 1: Information Security Governance, Section 1.4 (Information Security Concepts and Technologies).