Which of the following should have the MOST influence on the development of information security policies?

Information security policies are the highest-level internal documents that define an organization's security program. Their primary purpose is to support and enable the organization's mission and objectives. Therefore, the business strategy, which outlines these objectives, risk appetite, and overall direction, must be the most significant influence. Aligning security policies with the business strategy ensures that security initiatives are relevant, receive executive support, and contribute directly to the organization's success rather than being a purely technical or compliance-driven exercise.

B. Past and current threats: These are tactical inputs for risk assessments and control selection, which are guided by policy, not the primary drivers of the policy itself.

C. IT security framework: A framework (e.g., ISO 27001, NIST CSF) provides a structure to implement and manage the security program; it is a tool to execute the strategy, not the source of it.

D. Industry standards: These offer valuable baselines and best practices but must be tailored to the specific context, risk tolerance, and goals defined by the organization's business strategy.

---

1. ISACA

CISM Review Manual

16th Edition.

Domain 1: Information Security Governance

Section 1.4.1

Policy: "The information security policy is a high-level document that must be supported and approved by senior management. It should be driven by business objectives and state management’s commitment to information security." This explicitly states that policy is driven by business objectives

which are a core component of business strategy.

Domain 1: Information Security Governance

Section 1.3.1

Information Security Strategy Objectives: "The information security strategy must be aligned with the business strategy to support the organization’s business objectives." Since policy is a key component for implementing the strategy

it must also be aligned.

2. ISACA

COBIT 2019 Framework: Introduction and Methodology.

Section 3.2

The COBIT Goals Cascade: This core concept illustrates that governance and management objectives are derived from a cascade that begins with "Stakeholder Drivers and Needs

" which are translated into "Enterprise Goals." This demonstrates the principle that all governance activities

including policy creation

must trace back to and support the primary business strategy and goals.

3. Von Solms

B.

& Von Solms

R. (2004). The 10 deadly sins of information security management. Computers & Security

23(5)

371-376.

DOI: https://doi.org/10.1016/j.cose.2004.05.002

This foundational academic paper emphasizes that information security must be managed from the top down

driven by business needs. The failure to create a comprehensive security policy that is aligned with business objectives is cited as a critical mistake

reinforcing that business strategy is the paramount influence.