CISSP Practice Question: In a manufacturing company facing budget constraints and regulatory compliance, which strategy…

Correct Answer: D. Adopt a risk management framework

Explanation (CISSP Manager Logic):

A risk management framework (RMF) provides a structured, repeatable process to balance security requirements with business constraints. It allows management to prioritize resources based on actual risk levels, ensuring that budget is allocated to the most critical assets while maintaining regulatory compliance.

By adopting a risk management framework, you:

• Align security investments with organizational risk appetite and budget.
• Establish a consistent methodology for meeting diverse regulatory requirements.
• Enable data-driven decision-making for asset protection and mitigation.

While the other options are relevant, they fall short because:

• A: Data classification is a foundational component of security but lacks the strategic scope to manage overall risk and compliance.
• B: Awareness training addresses the human element but does not provide a structural strategy for asset protection or budgeting.
• C: Third-party audits provide a point-in-time assessment rather than a continuous management strategy for securing assets.

Think like a manager:

Security is a business enabler, not just a technical hurdle. Use frameworks to transform complex regulatory and budgetary constraints into a prioritized, defensible roadmap.