The new CISO was informed of all the Information Security projects that the organization has in progress. Two projects are over a year behind schedule and over budget. Using best business practices for project management you determine that the project correctly aligns with the company goals.
Which of the following needs to be performed NEXT?

A missing/ineffective security control is identified.
Which of the following should be the NEXT step?

From an information security perspective, information that no longer supports the main purpose of the business should be:

Which of the following is considered to be an IT governance framework and a supporting toolset that allows for managers to bridge the gap between control requirements, technical issues, and business risks?

Which of the following information would MOST likely be reported at the board-level within an organization?