Which set of elements should a complete security program include?

Which set of elements should a complete security program include?

• A. Policies and training
• B. All of the above
• C. Incident response planning
• D. Risk assessment

Answer: (B)

A complete security program must cover governance, capability, and readiness. Policies establish the rules, roles, and expectations that guide behavior and decisions. Training then turns those rules into practiced actions, ensuring everyone knows how to respond and protect assets. A risk assessment identifies what needs protection by evaluating assets, threats, and vulnerabilities, helping to prioritize where to apply controls. Incident response planning provides a clear, tested method for detecting, containing, and recovering from incidents, which depends on both established policies and trained personnel and is shaped by the risk picture. When you combine these elements, you get a comprehensive program that addresses governance, execution, and preparedness. Focusing on only one or two leaves gaps, so including all of them is the best approach.

A complete security program must cover governance, capability, and readiness. Policies establish the rules, roles, and expectations that guide behavior and decisions. Training then turns those rules into practiced actions, ensuring everyone knows how to respond and protect assets. A risk assessment identifies what needs protection by evaluating assets, threats, and vulnerabilities, helping to prioritize where to apply controls. Incident response planning provides a clear, tested method for detecting, containing, and recovering from incidents, which depends on both established policies and trained personnel and is shaped by the risk picture. When you combine these elements, you get a comprehensive program that addresses governance, execution, and preparedness. Focusing on only one or two leaves gaps, so including all of them is the best approach.