CISSP Practice Question: In a mid-sized financial institution, which approach should be prioritized to ensure…

Correct Answer: C. Implementing a risk management framework

Explanation (CISSP Manager Logic):

A risk management framework (RMF) provides the structured, repeatable process necessary to align security activities with business objectives and regulatory requirements. It ensures that risk decisions are consistent, documented, and based on the organization’s specific risk appetite rather than ad-hoc reactions.

By implementing this solution, you:

• Establish a holistic, lifecycle-based approach to security.
• Standardize risk identification and mitigation across the enterprise.
• Provide a foundation for meeting multiple regulatory compliance mandates.

While the other options are relevant, they fall short because:

• A: Technology is a tool to implement controls, but it cannot define the strategy or risk tolerance.
• B: Adding headcount without a structured framework leads to inefficient, siloed compliance efforts.
• D: Audits are point-in-time snapshots that verify compliance but do not manage day-to-day risk.

Think like a manager:

Prioritize process and strategy over technical tools. A framework ensures that every security dollar spent is directly mapped to a known risk or business requirement.