CISSP Practice Question: In a large healthcare organization facing new cybersecurity regulations, which is MOST…

Correct Answer: B. Conducting a comprehensive risk assessment

Explanation (CISSP Manager Logic):

A risk assessment is the foundational step for aligning security investments with regulatory requirements and business objectives. It allows management to identify specific gaps and prioritize resources based on actual risk rather than technical guesswork.

By conducting a risk assessment, you:

• Identify specific compliance gaps against new regulations.
• Prioritize remediation efforts based on business impact.
• Ensure security controls support rather than hinder operational workflows.

While the other options are relevant, they fall short because:

• A: Replacing a core system is costly and may introduce new risks without addressing the underlying compliance gaps.
• C: Outsourcing transfers tasks but not the ultimate accountability for regulatory compliance and strategic oversight.
• D: Infrastructure upgrades are technical solutions that may not address administrative or physical regulatory requirements.

Think like a manager:

Always assess before you act. Strategic decisions must be data-driven to ensure that security measures provide the highest return on investment while meeting legal obligations.