Explanation/Reference:
Explanation:
Although business process owners, an information security manager and the security steering committee may provide input regarding a configuration management plan, its final approval is the primary responsibility of IT senior management.

Explanation
Planning is the key to effective implementation of information security governance. Consultation, negotiation and facilitation come after planning.

Section: INFORMATION SECURITY GOVERNANCE
Explanation/Reference:

Linking realistic threats to key business objectives will direct executive attention to them. All other options are supportive but not of as great a value as choice C when trying to obtain the funds for a new program.

Explanation/Reference:
Explanation:
The first step in implementing information security governance is to define the security strategy based on which security baselines are determined. Adopting suitable security- standards, performing risk assessment and implementing security policy are steps that follow the definition of the security strategy.