A strategy is only real once it is funded and staffed. The information security manager competes for money and people with every other part of the business, so CISM expects you to argue in business terms. The main tool is the business case: a document that explains a problem, the options for addressing it, their costs and benefits, and a recommendation that leadership can approve or reject. A business case also creates a record against which the investment can later be judged.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 6 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.