Section: INFORMATION SECURITY GOVERNANCE
Explanation:
Management is primarily interested in security solutions that can address risks in the most cost-effective way.
To address the needs of an organization, a business case should address appropriate security solutions in line with the organizational strategy.

Section: INFORMATION SECURITY PROGRAM MANAGEMENT

Explanation
A change control process is the methodology that ensures that anything that could be impacted by a development change will be reevaluated. Problem management is the general process intended to manage all problems, not those specifically related to security. Background screening is the process to evaluate employee references when they are hired. BIA is the methodology used to evaluate risks in the business continuity process.

Explanation/Reference:
Explanation:
Senior management represented in the security steering committee is in the best position to advocate the establishment of and continued support for an information security program. The chief operating officer (COO) will be a member of that committee. An internal auditor is a good advocate but is secondary to the influence of senior management. IT management has a lesser degree of influence and would also be part of the steering committee.

Explanation/Reference:
Explanation:
Acceptance of a risk is an alternative to be considered in the risk mitigation process. Assessment.
evaluation and risk quantification are components of the risk analysis process that are completed prior to determining risk mitigation solutions.