The MOST effective approach to address issues that arise between IT management, business
units and security management when implementing a new security strategy is for the information
security manager to:

A.
escalate issues to an external third party for resolution.

B.
ensure that senior management provides authority for security to address the issues.

C.
insist that managers or units not in agreement with the security solution accept the risk.

D.
refer the issues to senior management along with any security recommendations.

Explanation:

Senior management is in the best position to arbitrate since they will look at the overall needs of
the business in reaching a decision. The authority may be delegated to others by senior
management after their review of the issues and security recommendations. Units should not be
asked to accept the risk without first receiving input from senior management.