CISSP Practice Question: As the CISO of a mid-sized healthcare organization, what is the PRIMARY…

Correct Answer: A. Regulatory compliance requirements

Explanation (CISSP Manager Logic):

In highly regulated sectors like healthcare, legal and regulatory mandates dictate the minimum necessary standards for data protection and breach notification. These requirements serve as the non-negotiable foundation for incident response, ensuring the organization avoids crippling legal penalties and loss of license.

By prioritizing compliance, you:

• Establish a legally defensible security posture.
• Define mandatory reporting timelines and stakeholder communication.
• Align technical response procedures with industry-specific mandates like HIPAA.

While the other options are relevant, they fall short because:

• B: Budget is a resource constraint, but it does not define the legal obligations or the scope of the response plan.
• C: Training is an operational necessity for execution, but the content of that training must be derived from the compliant plan.
• D: Technology tools are tactical enablers that must be selected based on their ability to meet regulatory and business requirements.

Think like a manager:

Always prioritize legal and regulatory requirements first, as they define the organization’s risk appetite and mandatory operational boundaries. Strategic planning must start with "what we must do" before determining "how we will do it."