Which sequence best describes the security program lifecycle from assessment to improvement?

Which sequence best describes the security program lifecycle from assessment to improvement?

• A. Plan, budget, deploy, retire, train
• B. Assess current state, design controls, implement, monitor, audit, analyze gaps, update plan, and repeat
• C. Hire staff, assign duties, monitor, report
• D. Assess, implement, enforce, terminate

Answer: (B)

Continuous improvement is what the best security program lifecycle aims for: a repeating loop from evaluation to enhancement. You begin by assessing the current state to know where you stand—the baseline for risk, controls, and gaps. Then you design controls that specifically address those gaps and align with policy and compliance needs. After that, you implement the controls in the environment. With implementation in place, you monitor how they perform in real operation and watch for issues or changes in risk. An audit provides an independent check on whether controls meet standards and are effective. Analyzing the gaps uncovered by monitoring and auditing guides updating the plan with revised priorities, resourcing, and timelines. Then you repeat the whole cycle to adapt to new threats and business changes.

Continuous improvement is what the best security program lifecycle aims for: a repeating loop from evaluation to enhancement. You begin by assessing the current state to know where you stand—the baseline for risk, controls, and gaps. Then you design controls that specifically address those gaps and align with policy and compliance needs. After that, you implement the controls in the environment. With implementation in place, you monitor how they perform in real operation and watch for issues or changes in risk. An audit provides an independent check on whether controls meet standards and are effective. Analyzing the gaps uncovered by monitoring and auditing guides updating the plan with revised priorities, resourcing, and timelines. Then you repeat the whole cycle to adapt to new threats and business changes.