CISSP Practice Question: In a multinational organization, which strategy is BEST for prioritizing security investments…

Correct Answer: A. Implementing a risk-based approach

Explanation (CISSP Manager Logic):

A risk-based approach aligns security spending with the organization’s specific threat landscape and business objectives. This ensures limited resources are allocated to the areas of highest impact, protecting critical assets while supporting business continuity.

By implementing this solution, you:

• Prioritize investments based on actual business impact and likelihood.
• Justify security expenditures to stakeholders using quantifiable data.
• Ensure security strategy supports, rather than hinders, organizational goals.

While the other options are relevant, they fall short because:

• B: Compliance focuses on meeting minimum legal standards rather than addressing specific operational risks.
• C: Adopting new technology without a risk assessment leads to wasted capital and "shiny object syndrome."
• D: Training is a vital control but does not provide a framework for prioritizing overall security investments.

Think like a manager:

Security is a business enabler that must balance protection with cost. Use risk management to ensure every dollar spent reduces the most significant threats to the mission.