Senior management commitment and support for information security will BEST be attained by an
information security manager by emphasizing:

A.
organizational risk.

B.
organization wide metrics.

C.
security needs.

D.
the responsibilities of organizational units.

Explanation:

Information security exists to help the organization meet its objectives. The information security
manager should identify information security needs based on organizational needs. Organizational
or business risk should always take precedence. Involving each organizational unit in information
security and establishing metrics to measure success will be viewed favorably by senior
management after the overall organizational risk is identified.