Cybersecurity Management and Emerging Developments

Introduction

Cybersecurity management is the organized process of identifying information risks, selecting proportionate controls, assigning responsibility, measuring performance, and improving protection over time. It connects technical security activities—such as identity management, vulnerability remediation, monitoring, backup, and incident response—with organizational objectives, legal duties, financial constraints, and ethical responsibilities.

Security management is increasingly difficult because organizations depend on cloud services, mobile devices, software supply chains, operational technology, artificial intelligence (AI), and extensive third-party relationships. Digital transformation can increase efficiency and customer value, but it also expands the attack surface. At the same time, attackers use automation, generative AI, stolen credentials, deepfakes, and ransomware-as-a-service to increase the speed and scale of attacks.

A sound security program therefore cannot be based only on purchasing tools. It requires risk-based decisions, measurable objectives, informed leadership, competent people, and continuous learning. This chapter develops a practical foundation for creating a security improvement plan and examines major developments that will influence cybersecurity practice.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Explain the role of governance, risk, compliance, and security management.
2. Develop a basic risk-based security improvement plan.
3. Select useful security metrics and distinguish activity measures from outcome measures.
4. Construct a simple cybersecurity budget and prioritize competing investments.
5. Explain how digital transformation changes cyber risk.
6. Describe AI-enabled attacks, AI-assisted defenses, automation, and their limitations.
7. Explain the significance of post-quantum cryptography.
8. Identify major regulatory, workforce, ethical, and continuous-learning issues.

1. Cybersecurity Management as a Socio-Technical Discipline

Cybersecurity is socio-technical: outcomes result from interactions among people, processes, technologies, suppliers, and the surrounding legal and business environment. A technically strong firewall cannot compensate for excessive privileges, untrained staff, unsupported software, or unclear accountability.

Security management commonly includes the following activities:

• Governance: establishing authority, policies, objectives, risk appetite, and accountability.
• Risk management: identifying threats and vulnerabilities, estimating risk, selecting treatments, and accepting residual risk.
• Asset management: maintaining knowledge of hardware, software, data, identities, services, and suppliers.
• Control management: designing, implementing, testing, and improving safeguards.
• Assurance: checking whether controls exist, operate effectively, and satisfy obligations.
• Incident management: preparing for, detecting, containing, responding to, and learning from incidents.
• Resilience management: ensuring that important services can continue or recover after disruption.

Governance differs from management. Governance determines direction and accountability; management plans and executes activities within that direction. A board or senior leadership team may approve risk appetite and funding, while security managers implement controls and report performance.

The security objectives

The traditional confidentiality, integrity, and availability (CIA) triad remains a useful starting model:

• Confidentiality: information is accessible only to authorized subjects.
• Integrity: information and systems remain accurate, complete, and protected from unauthorized modification.
• Availability: authorized users can access services and information when needed.

Modern programs also emphasize authenticity, accountability, privacy, safety, and resilience. For example, integrity and availability are especially important in industrial control systems, while privacy and fairness are critical in systems processing personal data or making decisions about individuals.

2. Frameworks for Organizing Security Work

A framework is not a substitute for judgment, but it provides a common language and prevents important activities from being overlooked. Widely used approaches include the NIST Cybersecurity Framework, ISO/IEC 27001, CIS Critical Security Controls, COBIT, and sector-specific standards. Their terminology differs, but most address similar questions:

1. What assets, data, dependencies, and risks exist?
2. Which safeguards reduce those risks?
3. How are events detected and handled?
4. How does the organization recover and improve?

The NIST Cybersecurity Framework 2.0 organizes outcomes under Govern, Identify, Protect, Detect, Respond, and Recover. ISO/IEC 27001 emphasizes an information security management system (ISMS), risk treatment, documented controls, leadership involvement, and continual improvement. CIS Controls provide a prioritized set of practical safeguards, such as asset inventory, secure configuration, account management, vulnerability management, logging, and incident response.

These frameworks should be adapted to organizational context. A small community college, a hospital, and a cloud software provider do not require identical controls. The relevant question is not whether every control has been purchased, but whether important risks are reduced to an acceptable level.

3. Risk-Based Decision-Making

Risk can be described qualitatively or quantitatively. A common qualitative model is:

Risk = likelihood × impact

Here, likelihood is the estimated chance that a harmful event will occur during a defined period, and impact is the magnitude of consequences if it occurs. The expression is a decision aid rather than a universal law. Likelihood and impact may be expressed as categories such as low, medium, and high; multiplying ordinal categories does not create a precise probability or monetary value.

For a quantitative analysis, annualized loss expectancy (ALE) may be used:

Where:

• ALE is annualized loss expectancy, measured in currency per year;
• SLE is single-loss expectancy, the estimated loss from one event, measured in currency;
• ARO is annual rate of occurrence, the expected number of events per year.

This model assumes that losses can be reasonably estimated and that the event rate is meaningful over the planning period. It does not capture every consequence, such as legal uncertainty, reputational harm, safety effects, or correlated failures. It should support—not replace—professional judgment.

Worked example: comparing a control investment

An organization estimates that a particular ransomware scenario could cause a single loss of $80,000. It expects the scenario to occur 0.25 times per year.

ALE = 80,000 × 0.25 = $20,000 per year

A proposed control costs $9,000 annually and is expected to reduce the event frequency by 60%. The residual ARO is:

0.25 × (1 − 0.60) = 0.10

The residual ALE is:

80,000 × 0.10 = $8,000 per year

The estimated annual loss reduction is $12,000. A simple expected monetary benefit net of annual control cost is:

$12,000 − $9,000 = $3,000 per year

The proposal appears financially favorable under these assumptions. However, the decision may be justified even more strongly if the control reduces safety risks, regulatory exposure, or operational disruption that was not included in the estimate.

Risk treatment options

A risk owner normally chooses one or more of four treatments:

• Mitigate: implement controls to reduce likelihood or impact.
• Avoid: stop or redesign the activity creating the risk.
• Transfer or share: use insurance, contracts, or an external provider, recognizing that accountability is not completely transferred.
• Accept: consciously retain the residual risk within approved risk appetite.

Risk acceptance must be explicit, time-bounded where appropriate, and approved by someone with suitable authority. Silence is not a valid risk treatment.

4. Building a Basic Security Improvement Plan

A security improvement plan translates assessment findings into sequenced, funded, and measurable action. A useful plan contains the following elements.

Step 1: Establish scope and objectives

Define the organizational units, systems, data, suppliers, and services being considered. Objectives should connect security to business outcomes. Examples include reducing successful phishing compromise, protecting student records, improving recovery from ransomware, or meeting a contractual security requirement.

Step 2: Create an evidence-based baseline

Collect available evidence: asset inventories, identity records, vulnerability scans, configuration reviews, incident reports, audit findings, backup tests, penetration tests, and staff interviews. Record uncertainty rather than assuming that undocumented controls exist.

Step 3: Identify and rank gaps

For each gap, describe the affected asset, threat, vulnerability, business consequence, existing safeguards, proposed action, owner, deadline, cost, and dependencies. Rank items using severity, exploitability, business criticality, regulatory importance, and feasibility.

A practical prioritization matrix might classify actions as follows:

Priority must be revisited when threats, technologies, or business processes change.

Step 4: Define actions and ownership

Every action should have one accountable owner, supporting participants, a completion condition, and a review date. “Improve security” is not an actionable task. “Enable phishing-resistant multifactor authentication for privileged accounts by 30 September, verified by an access review” is more useful.

Step 5: Fund and sequence the work

Dependencies matter. Asset inventory and identity cleanup may need to occur before reliable vulnerability prioritization. Logging improvements may be required before meaningful detection metrics can be reported. High-risk, low-cost actions are often early priorities, but large strategic projects may be necessary for sustainable improvement.

Step 6: Measure, review, and adjust

A plan is not complete when tasks are marked finished. The organization should verify whether risk has actually decreased and whether controls continue to operate. Findings should enter a recurring management review cycle.

5. Metrics and Measurement

Metrics make security performance visible, but poor metrics can encourage misleading behavior. A metric should have a clear definition, data source, owner, frequency, target, and interpretation.

Useful categories include:

• Coverage metrics: percentage of assets inventoried, endpoints protected, or privileged accounts using multifactor authentication.
• Timeliness metrics: median time to remediate critical vulnerabilities, mean time to detect, and mean time to contain.
• Outcome metrics: number of confirmed account compromises, recurrence of incidents, or successful recovery from restoration tests.
• Reliability metrics: percentage of critical logs received, backup job success rate, or false-positive rate in detection systems.
• Behavioral metrics: phishing-reporting rate, completion of role-relevant training, or use of approved data-sharing mechanisms.

Activity is not the same as effectiveness. The number of training hours may rise while unsafe behavior remains unchanged. The number of alerts may increase because monitoring improved, not because security worsened. Metrics must therefore be interpreted with context and paired with qualitative evidence.

For a proportion metric, the basic calculation is:

For example, if 180 of 200 privileged accounts use multifactor authentication, coverage is (180 ÷ 200) × 100 = 90%. The organization must still ask whether the remaining ten percent includes the most sensitive accounts.

Good reporting distinguishes leading indicators, which signal future performance, from lagging indicators, which record outcomes after events. Tested backups are a leading indicator of recoverability; confirmed data loss is a lagging outcome.

6. Budgeting and Security Investment

Cybersecurity budgets should be connected to risk and service requirements rather than expressed only as a fixed percentage of information-technology spending. A basic budget includes:

• personnel and professional development;
• security software, hardware, and cloud services;
• monitoring and managed services;
• assessment, testing, and audit;
• incident response and legal support;
• backup, resilience, and recovery capabilities;
• communication, awareness, and exercises; and
• contingency funding for urgent risk reduction.

Budget proposals should state assumptions, one-time and recurring costs, dependencies, expected risk reduction, and consequences of deferral. Total cost of ownership includes licensing, integration, administration, training, renewal, and eventual replacement—not merely purchase price.

A low-cost control can have high value, but a cheap tool that generates unreviewed alerts may increase risk. Conversely, an expensive control may be justified when it protects safety-critical operations or fulfills a mandatory obligation. Security leaders should present alternatives, such as minimum, target, and accelerated investment levels, so decision-makers understand trade-offs.

7. Digital Transformation and Its Security Consequences

Digital transformation integrates digital technologies into products, operations, decision-making, and customer services. Examples include cloud migration, application programming interfaces, remote work, Internet of Things devices, software-defined infrastructure, data analytics, and automated business processes.

Transformation can improve patching, scalability, observability, and resilience, but it also creates new risks:

• identity becomes the main security boundary in distributed environments;
• APIs expose business functions to external callers;
• cloud misconfiguration can expose data at large scale;
• software dependencies create supply-chain risk;
• connected devices may be difficult to patch;
• rapid development can outpace security review; and
• concentration in a major provider can create systemic dependency.

Security should be integrated through secure-by-design and secure-by-default practices. These include threat modeling, strong identity controls, least privilege, secrets management, encryption, code review, dependency analysis, infrastructure-as-code review, logging, and tested recovery. “Shift left” is useful when it means addressing defects earlier, but it must not imply that operations, monitoring, and governance are no longer needed.

8. AI-Enabled Attacks and Defenses

Attackers can use AI to generate convincing phishing messages, translate content, automate reconnaissance, create synthetic voices or images, identify vulnerable code, and adapt social-engineering campaigns. AI lowers the cost of producing plausible content, but it does not eliminate the need for attacker infrastructure, access, or strategic judgment.

Defenders use AI and machine learning for anomaly detection, malware classification, alert triage, identity-risk analysis, fraud detection, code analysis, and security-operations assistance. Generative systems may summarize alerts, draft queries, or help analysts investigate incidents.

AI introduces significant limitations:

• training data may be incomplete, biased, poisoned, or stale;
• models can produce confident but incorrect outputs;
• attackers can evade or manipulate detection systems;
• sensitive data may be exposed through prompts or logs;
• automated decisions may be difficult to explain;
• models and third-party services create supply-chain dependencies; and
• excessive automation can amplify a single error.

Organizations should maintain human accountability, restrict sensitive inputs, test models against realistic threats, log model use, evaluate false positives and false negatives, and provide safe fallback procedures. AI should generally recommend or prioritize high-impact actions until its reliability and authorization controls are demonstrated. Security teams must also protect AI systems themselves, including model endpoints, training data, prompts, plugins, and access tokens.

9. Automation and Security Operations

Automation can apply routine controls consistently and reduce analyst workload. Examples include automatic isolation of a compromised endpoint, account disablement after verified indicators, ticket creation, vulnerability scanning, certificate renewal, and compliance evidence collection.

Automation should be designed with:

1. a clearly defined trigger;
2. trusted and sufficiently accurate input data;
3. an authorized action;
4. limits on scope and duration;
5. logging and auditability;
6. rollback or recovery capability; and
7. human escalation for ambiguous or high-impact cases.

A useful principle is proportional automation. Reversible actions, such as adding a temporary detection rule, may be automated more readily than irreversible actions, such as deleting an account or wiping a system. Automation is not a replacement for sound processes; it can make a flawed process operate faster.

10. Post-Quantum Cryptography

Many public-key cryptographic systems rely on mathematical problems that are difficult for conventional computers, including integer factorization and discrete logarithms. A sufficiently capable quantum computer running Shor’s algorithm could threaten widely deployed public-key mechanisms. Grover’s algorithm provides a quadratic search advantage against some symmetric-key applications, generally addressed by using appropriately larger symmetric keys.

The timing of a cryptographically relevant quantum computer is uncertain, but migration requires years because organizations have long-lived data, embedded systems, certificates, protocols, and supplier dependencies. The “harvest now, decrypt later” risk is especially relevant to information that must remain confidential for many years.

Post-quantum cryptography (PQC) uses algorithms intended to resist known quantum attacks while running on conventional computers. Current standardization efforts emphasize families such as lattice-based and hash-based schemes. Organizations should not replace cryptography casually or treat one algorithm as permanently guaranteed. They should inventory cryptographic use, classify data by confidentiality lifetime, identify systems with long replacement cycles, seek crypto-agility, follow authoritative standards, test performance, and monitor validated implementations.

PQC migration is an engineering and governance project, not only a mathematical upgrade. It may affect certificate sizes, network bandwidth, hardware, protocols, procurement, and interoperability. Hybrid approaches may be used during transition where appropriate and supported by standards.

11. Regulation, Privacy, and Ethical Governance

Cybersecurity regulation varies by jurisdiction and sector. Organizations may face requirements concerning personal-data protection, breach notification, critical infrastructure, payment systems, health information, financial services, software security, records retention, and board or executive reporting. Contracts can impose additional duties even where legislation does not.

A responsible compliance program maps obligations to controls, evidence, owners, and reporting deadlines. Compliance is a baseline, not proof that an organization is secure. A control implemented only to pass an audit may fail in practice if it is not maintained or tested.

Ethical security management requires proportionality, respect for privacy, fairness, and avoidance of unnecessary harm. Monitoring employees or students should have a legitimate purpose, clear notice where required, limited collection, access controls, retention limits, and independent oversight. Penetration testing requires written authorization and defined scope. Vulnerability disclosure should provide a safe and responsible channel for researchers.

AI and analytics raise additional questions about explainability, discrimination, consent, data provenance, and accountability. Human oversight is particularly important where automated security decisions can affect employment, access to services, or individual reputation.

12. Workforce and Continuous Learning

Cybersecurity work is performed by specialists and by people whose primary roles are elsewhere. Essential capability areas include governance, risk analysis, identity administration, secure development, cloud security, digital forensics, incident response, privacy, communication, and business understanding.

A workforce plan should identify current capability, future demand, critical role dependencies, recruitment options, internal development, outsourcing boundaries, and succession arrangements. It should also address burnout. Excessive on-call demands, repetitive alert handling, and insufficient staffing can increase error and turnover.

Effective learning is role-based and continuous. Awareness for all employees should be supplemented by practical training for administrators, developers, executives, procurement staff, and incident coordinators. Exercises, simulations, tabletop events, peer review, professional communities, and post-incident learning are often more valuable than annual checkbox training.

Continuous learning also means tracking changes in threats, law, technology, and organizational processes. A security plan should be revised when a new service is introduced, a major incident occurs, a critical supplier changes, or evidence shows that a control is ineffective.

Applied Case: Illustrative Regional College Improvement Plan

Background

Riverland College, a fictional regional college, operates a student information system, learning-management platform, research services, administrative applications, and a hybrid workforce. It has 8,000 students, 900 staff members, and limited security personnel.

Problem

An assessment found incomplete asset records, inconsistent multifactor authentication, unsupported laboratory computers, weak supplier visibility, and backups that had not been restored in a full test. A recent phishing incident resulted in one staff account being compromised, although no confirmed data exfiltration occurred.

Analysis

The college ranked risks according to service criticality, data sensitivity, exploitability, and recovery difficulty. The student information system and identity provider were classified as high-priority assets. The assessment showed that a small number of administrative identities could affect many services, creating concentration risk.

Approach and solution

The college adopted a 12-month plan:

The plan used a modest contingency budget for urgent remediation and required each action to have an accountable owner. The college did not purchase an expensive AI detection platform before improving identity, asset, and logging foundations.

Outcome

At the end of the period, the college had better visibility, stronger administrative authentication, tested restoration procedures, and clearer supplier responsibilities. It still had unresolved legacy-system risks, which leadership formally accepted for a limited period while replacement funding was considered.

Learning points

The case illustrates that improvement is cumulative. Basic visibility and identity controls often provide more immediate value than sophisticated tools. Metrics must measure coverage and outcomes, not merely procurement or training activity. Formal risk acceptance is preferable to pretending that all risks have been eliminated.

Challenges and Limitations

Security planning is affected by uncertainty. Threat intelligence may be incomplete, probabilities may be subjective, dependencies may be hidden, and impacts may be difficult to monetize. Risk models can create false precision when estimates are treated as facts. Frameworks can become compliance exercises, metrics can be gamed, and automation can amplify errors.

Other persistent challenges include legacy technology, fragmented ownership, supply-chain opacity, privacy constraints, limited budgets, skills shortages, and conflicting priorities. No control is perfect. Defense in depth, segmentation, recovery capability, independent testing, and honest reporting are necessary because prevention will eventually fail.

Best-Practice Checklist

• Establish leadership accountability and a documented risk appetite.
• Maintain inventories of assets, identities, data, suppliers, and cryptographic dependencies.
• Prioritize identity, secure configuration, vulnerability management, logging, backups, and incident response.
• Assign owners and deadlines to every improvement action.
• Use metrics with definitions, data sources, targets, and context.
• Present security budgets through risk, service impact, and total cost of ownership.
• Build security into digital transformation and procurement from the beginning.
• Validate AI outputs and keep humans accountable for high-impact decisions.
• Automate proportionately, with logging, authorization, limits, and rollback.
• Begin post-quantum preparation through inventory and crypto-agility.
• Map legal and contractual duties to evidence and operational controls.
• Develop role-based skills and learn from exercises and incidents.
• Reassess the plan continuously as technology and threats evolve.

Chapter Summary

Cybersecurity management combines governance, risk treatment, technical controls, people, processes, budgeting, measurement, and continual improvement. A basic improvement plan begins with scope and evidence, ranks gaps according to risk, assigns accountable owners, funds sequenced actions, and verifies outcomes through meaningful metrics. Quantitative tools such as annualized loss expectancy can support decisions, but estimates must be treated cautiously and supplemented by judgment.

Digital transformation expands both capability and attack surface, making identity, secure design, supply-chain oversight, monitoring, and recovery essential. AI and automation can improve defensive efficiency while introducing errors, privacy concerns, manipulation risks, and accountability challenges. Post-quantum cryptography requires long-term preparation because migration affects systems, protocols, suppliers, and data with extended confidentiality requirements. Finally, effective security depends on ethical governance, regulatory awareness, adequate staffing, role-based learning, and continuous adaptation.

Key Terms

Governance: Direction, oversight, authority, and accountability for organizational activities.

Risk appetite: The amount and type of risk an organization is willing to pursue or retain.

Residual risk: Risk remaining after safeguards and treatments are applied.

Risk owner: Person accountable for managing and accepting a particular risk.

CIA triad: Confidentiality, integrity, and availability.

Annualized loss expectancy (ALE): Expected loss per year based on estimated event loss and frequency.

Single-loss expectancy (SLE): Estimated loss from one occurrence of an adverse event.

Annual rate of occurrence (ARO): Expected number of occurrences in one year.

Security control: Safeguard designed to prevent, detect, correct, or reduce a risk.

Security metric: Defined measurement used to assess security activity, capability, or outcome.

Leading indicator: Measure that may signal future performance or risk.

Lagging indicator: Measure of an outcome that has already occurred.

Digital transformation: Use of digital technologies to change products, services, processes, or decisions.

Attack surface: The collection of exposed points through which systems or organizations may be attacked.

Artificial intelligence: Computational systems that perform tasks associated with learning, reasoning, perception, or generation.

Security automation: Use of technology to execute security actions with limited manual intervention.

Post-quantum cryptography: Cryptographic methods designed to resist attacks from both conventional and quantum-capable computers.

Crypto-agility: Ability to change cryptographic algorithms and implementations with limited disruption.

Residual risk acceptance: Explicit authorization to retain a remaining risk.

Secure by design: Integrating security requirements and safeguards throughout system design and development.

Review Questions

Short Answer Questions

1. What is the difference between governance and security management?
2. Define confidentiality, integrity, and availability.
3. Name four possible treatments for cybersecurity risk.
4. Why can activity metrics give a misleading picture of security effectiveness?
5. What is crypto-agility, and why is it useful?

Long Answer Questions

1. Explain how an organization should develop a basic security improvement plan from initial assessment through review and adjustment.
2. Discuss the advantages and limitations of using annualized loss expectancy in cybersecurity budgeting.
3. Explain how digital transformation changes the security responsibilities of an organization.
4. Compare the benefits and risks of AI-assisted defense and security automation.
5. Discuss the workforce, ethical, and regulatory requirements of a contemporary cybersecurity program.

Analytical / Application Questions

1. An organization has incomplete asset records, weak administrative authentication, and limited funds. Which actions should be prioritized first, and what evidence would support your decision?
2. A security team reports that alert volume has doubled after deploying a new monitoring system. Analyze at least three possible interpretations and identify additional metrics needed before judging performance.
3. Design a one-year improvement plan for a small organization preparing for post-quantum cryptography. Identify immediate activities, ownership, metrics, and major uncertainties.

Multiple Choice Questions with Answers

Question 1

Which activity is primarily a governance responsibility?

A. Approving organizational risk appetite and accountability

B. Running a daily vulnerability scan

C. Resetting a user password

D. Installing an endpoint agent

Correct Answer: A. Approving organizational risk appetite and accountability

Question 2

In the formula ALE = SLE × ARO, what does ARO represent?

A. Average risk exposure

B. Annual rate of occurrence

C. Authorized recovery operation

D. Asset remediation objective

Correct Answer: B. Annual rate of occurrence

Question 3

A control reduces an event's frequency from 0.25 to 0.10 events per year. What percentage reduction does this represent?

A. 40%

B. 50%

C. 60%

D. 75%

Correct Answer: C. 60%

Question 4

Which is an outcome-oriented security metric?

A. Number of awareness slides published

B. Number of security meetings held

C. Percentage of staff enrolled in training

D. Number of confirmed account compromises

Correct Answer: D. Number of confirmed account compromises

Question 5

Which action is generally a risk mitigation treatment?

A. Ignoring an undocumented risk

B. Implementing multifactor authentication

C. Removing the risk register

D. Accepting every supplier's terms without review

Correct Answer: B. Implementing multifactor authentication

Question 6

Why should AI-generated security recommendations be reviewed by humans?

A. AI systems cannot process any security data

B. AI outputs may be incorrect, biased, or manipulated

C. Human review eliminates all cyber risk

D. Regulations prohibit every use of AI

Correct Answer: B. AI outputs may be incorrect, biased, or manipulated

Question 7

Which practice supports safe security automation?

A. Allowing irreversible actions without logging

B. Using unclear triggers and unlimited scope

C. Providing authorization, audit logs, and rollback capability

D. Removing escalation procedures

Correct Answer: C. Providing authorization, audit logs, and rollback capability

Question 8

What is a major reason to begin post-quantum preparation before a quantum computer is available?

A. All current symmetric encryption has already failed

B. Migration can require years and attackers may collect data for later decryption

C. Post-quantum algorithms require no testing

D. Quantum computers make passwords unnecessary

Correct Answer: B. Migration can require years and attackers may collect data for later decryption

Question 9

Which statement best describes compliance?

A. Compliance guarantees that no incident will occur

B. Compliance is unrelated to operational security

C. Compliance provides obligations and evidence requirements but is not complete proof of security

D. Compliance eliminates the need for risk assessment

Correct Answer: C. Compliance provides obligations and evidence requirements but is not complete proof of security

Question 10

Which sequence best reflects a risk-based improvement process?

A. Purchase tools, then identify assets, then assign responsibility

B. Identify scope and evidence, prioritize risks, assign actions, fund, measure, and reassess

C. Train everyone once, then close the security program

D. Accept all risks before examining business impact

Correct Answer: B. Identify scope and evidence, prioritize risks, assign actions, fund, measure, and reassess