CISSP Practice Question: In a healthcare organization facing budget constraints and regulatory compliance challenges, which…

Correct Answer: B. Conducting a comprehensive risk assessment

Explanation (CISSP Manager Logic):

A manager must identify and prioritize risks before allocating limited resources or selecting specific technical controls. In a budget-constrained environment, a risk assessment provides the data-driven justification needed to align security spending with the organization's most critical regulatory and operational needs.

By conducting a comprehensive risk assessment, you:

• Identify high-impact vulnerabilities and regulatory compliance gaps.
• Justify budget requests using data-driven risk prioritization.
• Ensure security investments provide the highest return on investment.

While the other options are relevant, they fall short because:

• A: Implementing a firewall is a tactical control that may not address the organization's most significant risks.
• C: Training is essential, but its focus cannot be effectively determined without first understanding the risk landscape.
• D: Infrastructure upgrades are costly and often prioritize performance over critical security threat mitigation.

Think like a manager:

Never commit resources to a solution before you have defined the problem. Assessment must always precede implementation to ensure strategic alignment and fiscal responsibility.