Cybersecurity Strategy, AI, and Future Developments

Introduction

Digital transformation has changed cybersecurity from a specialist technical function into an enterprise capability. Cloud services, application programming interfaces, mobile workforces, artificial intelligence (AI), connected devices, industrial control systems, and software supply chains have expanded both organisational value and exposure. A cybersecurity strategy must therefore do more than list security technologies. It must connect business objectives, information risks, legal duties, technology architecture, people, suppliers, and resilience outcomes.

A contemporary strategy is risk-aligned when it directs scarce resources toward the events that could most seriously affect organisational objectives. It is adaptive when it can respond to changing threats, technologies, regulations, and geopolitical conditions. It is governed when responsibilities, decision rights, assurance activities, and accountability are explicit.

This chapter examines how organisations can develop and implement such a strategy. It also considers AI-enabled security and AI-specific threats, automation, quantum computing, Internet of Things (IoT) and operational technology (OT), regulation, workforce capability, geopolitics, and emerging resilience models.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the components of a risk-aligned cybersecurity strategy.
2. Construct a cybersecurity roadmap that supports digital transformation.
3. Distinguish AI used for security from threats directed against AI systems.
4. Evaluate automation, quantum risk, IoT/OT exposure, regulation, and geopolitical risk.
5. Recommend governance, workforce, and resilience measures for future cybersecurity.
6. Apply strategic cybersecurity concepts to an organisational case.

1. Cybersecurity Strategy as an Enterprise Capability

A cybersecurity strategy is a set of coordinated choices about how an organisation will protect information, technology, services, people, and stakeholders while achieving its mission. It is not identical to a security policy. A policy states expected behaviour or mandatory controls; a strategy explains priorities, investment logic, capabilities, sequencing, and measures of success.

A mature strategy normally answers six questions:

• What business outcomes must be protected?
• Which risks could prevent those outcomes?
• What level of risk is acceptable?
• Which capabilities are required?
• Who owns decisions and residual risk?
• How will progress and effectiveness be demonstrated?

The strategy should be derived from business and digital objectives. For example, a bank introducing open banking may prioritise API security, identity assurance, fraud analytics, third-party risk, and continuous monitoring. A hospital expanding telemedicine may prioritise availability, patient safety, privacy, medical-device security, and clinical recovery procedures.

Strategic alignment

Strategic alignment is the relationship between organisational objectives and security investment. Security is not simply an expense that attempts to eliminate all threats. Complete prevention is generally impossible and economically inefficient. The purpose is to reduce risk to an acceptable level while preserving usability, innovation, and service delivery.

A useful distinction is:

• Inherent risk: exposure before considering controls.
• Control effectiveness: the extent to which controls prevent, detect, respond to, or recover from events.
• Residual risk: exposure remaining after controls.
• Risk appetite: the amount and type of risk the organisation is willing to accept.
• Risk tolerance: acceptable variation around a target or limit.

A simple expected-loss model can support prioritisation:

Here, EL is expected loss over a defined period, P is the probability of a specified adverse event during that period, and I is its impact expressed in a consistent monetary or scoring unit. The model assumes that probability and impact estimates refer to the same scenario and time horizon. It is a prioritisation aid, not a prediction; uncertainty, dependencies, non-financial harm, and correlated events must also be considered.

For instance, if a credible ransomware scenario has an annual probability of 0.20 and an estimated impact of £500,000, the simplified expected loss is £100,000 per year. This does not mean that the organisation will lose exactly £100,000, nor does it justify a control costing £100,000 automatically. Control benefits, implementation costs, risk reduction, safety effects, and strategic dependencies must be assessed.

2. Strategy Development and the Cybersecurity Roadmap

A practical strategy-development cycle contains the following stages.

Establish the mission and scope

The organisation first identifies critical services, information assets, users, technology dependencies, suppliers, and regulatory obligations. Scope should include cloud and outsourced services rather than focusing only on the internal network.

Assess the current state

A baseline evaluates governance, architecture, identity, data protection, vulnerability management, detection, response, continuity, workforce capability, and supplier controls. Frameworks such as the NIST Cybersecurity Framework, ISO/IEC 27001, CIS Controls, and sector-specific standards can provide structure. These frameworks should be treated as tools for comparison and improvement, not as substitutes for organisational judgement.

Define the target state

The target state describes the capabilities needed to support future business objectives. Examples include phishing-resistant authentication, centralised logging, secure-by-design development, tested recovery, AI model governance, and software supply-chain assurance.

Identify and prioritise gaps

A gap is meaningful only when connected to risk or an objective. “No central dashboard” is less useful than “inability to detect privileged-account misuse within the required response time.” Prioritisation should consider severity, likelihood, regulatory exposure, feasibility, dependencies, and time to benefit.

Sequence initiatives

A roadmap translates strategic goals into initiatives, owners, milestones, dependencies, resources, and measures. Foundational work often precedes advanced analytics. For example, reliable asset inventories, identity governance, logging, and data quality are prerequisites for effective AI-driven detection.

Measure and revise

A strategy should be reviewed after significant business, technology, threat, or regulatory change. Measures should include both activity and outcomes.

Roadmap horizons

A three-horizon roadmap is often useful:

• Horizon 1—stabilise: asset discovery, identity controls, vulnerability remediation, backups, incident procedures, and critical logging.
• Horizon 2—integrate: zero-trust architecture, secure development, supplier assurance, detection engineering, data governance, and resilience exercises.
• Horizon 3—optimise and anticipate: AI governance, automated response with safeguards, post-quantum migration, advanced threat modelling, and systemic resilience.

The horizons are not necessarily calendar years. Their purpose is to communicate capability maturity and dependencies.

3. Governance, Accountability, and Decision Rights

Cybersecurity governance determines who may decide, who must be consulted, and who is accountable for risk. The board or governing body generally approves risk appetite and receives assurance. Senior management allocates resources and resolves cross-functional conflicts. The chief information security officer leads security strategy, but business and system owners remain accountable for the risks created by their services.

A useful governance structure includes:

• Board or risk committee: oversight, challenge, and approval of risk appetite.
• Executive committee: prioritisation of investment and acceptance of significant residual risk.
• Security leadership: architecture, standards, monitoring, response, and advisory functions.
• Business and product owners: ownership of service risks and recovery requirements.
• Internal audit: independent evaluation of governance and controls.
• Legal, privacy, procurement, and human resources: specialist advice and shared accountability.

The separation of duties is important. A person who designs a control should not be the sole person who certifies its effectiveness. Likewise, accepting significant residual risk should be a conscious decision by an authorised owner, not an accidental result of project delay.

4. AI for Cybersecurity and Security of AI

AI creates two related but distinct strategic responsibilities.

AI for cybersecurity

Security teams may use machine learning and generative AI to classify alerts, detect anomalous behaviour, summarise incidents, search threat intelligence, generate detection rules, and assist analysts. These systems can improve speed and scale, but their outputs are probabilistic. They may produce false positives, false negatives, fabricated explanations, or unsafe recommendations.

Human oversight is especially important when an AI system can isolate systems, disable accounts, block transactions, or alter production configurations. A sensible control model assigns actions according to confidence and impact: low-impact actions may be automated, while high-impact actions require human approval.

Security of AI systems

AI systems introduce assets and attack surfaces that differ from conventional applications. Relevant threats include:

• Data poisoning: manipulation of training or fine-tuning data.
• Prompt injection: instructions designed to override an application’s intended behaviour.
• Sensitive information disclosure: leakage through prompts, outputs, logs, or model memorisation.
• Model theft: unauthorised extraction or replication of model behaviour.
• Adversarial examples: inputs crafted to cause incorrect classification.
• Supply-chain compromise: malicious models, libraries, datasets, or hosted services.
• Excessive agency: an AI agent possessing more privileges or tools than necessary.
• Bias and unsafe decisions: harmful outcomes caused by poor data, design, or context.

AI governance should cover purpose, data provenance, testing, access, monitoring, human oversight, documentation, incident response, and retirement. Model risk management should ask whether the system is appropriate for the decision, not merely whether it performs well on a benchmark.

AI threat modelling

Threat modelling should identify:

1. The model, data, prompts, tools, users, and external services.
2. Trust boundaries and privileged interfaces.
3. Potential confidentiality, integrity, availability, safety, fairness, and privacy harms.
4. Abuse cases and failure modes.
5. Preventive, detective, and corrective controls.

The principle of least privilege applies to AI agents just as it applies to human users. An agent that can read customer records and issue refunds should not receive unrestricted database or payment-system access.

5. Automation and Autonomous Defence

Automation is valuable when tasks are repetitive, rules are clear, data is reliable, and consequences are controlled. Examples include ticket enrichment, certificate renewal, malware quarantine, account-risk scoring, and patch deployment in tested environments.

Automation can also amplify error. A faulty rule may disable thousands of accounts; a poisoned data feed may trigger inappropriate responses; and an attacker who compromises an orchestration platform may gain powerful capabilities. Organisations should therefore apply:

• staged deployment and testing;
• approval thresholds based on action impact;
• rollback mechanisms;
• detailed audit logs;
• segregation of duties;
• rate limits and fail-safe defaults;
• regular review of automation rules;
• human escalation for ambiguous or high-consequence cases.

The strategic question is not whether a task can be automated, but whether the organisation can understand, constrain, audit, and recover from automated decisions.

6. Quantum Risk and Cryptographic Transition

Large-scale fault-tolerant quantum computers could threaten widely used public-key algorithms based on integer factorisation or discrete logarithms. Symmetric cryptography is affected differently; sufficiently strong key sizes and appropriate algorithms remain important defensive measures. The timing of the threat is uncertain, but “harvest now, decrypt later” creates a present concern for information requiring long-term confidentiality.

A quantum-readiness programme should:

1. Create an inventory of cryptographic algorithms, keys, certificates, protocols, and dependencies.
2. Identify data whose confidentiality or authenticity must remain protected for many years.
3. Prioritise systems that are difficult to replace, externally exposed, or safety critical.
4. Design cryptographic agility so algorithms can be changed without rebuilding entire systems.
5. Test post-quantum cryptographic options approved or recommended by relevant standards bodies.
6. Update supplier requirements and procurement language.

Quantum risk is not a reason to replace every cryptographic component immediately without analysis. Migration can introduce implementation errors, performance costs, interoperability problems, and new supply-chain dependencies. It is a portfolio and lifecycle-management issue.

7. IoT, OT, and Cyber-Physical Resilience

IoT devices commonly have limited processing power, long lifecycles, weak update mechanisms, and diverse ownership. OT systems control physical processes and often prioritise safety, availability, and deterministic operation over confidentiality. IT assumptions cannot simply be transferred to OT environments.

Key practices include asset discovery, network segmentation, secure remote access, identity management, vendor accountability, safe patch testing, configuration control, monitoring of industrial protocols, and manual fallback procedures. In OT, a vulnerability remediation decision must consider process safety and operational consequences. Disconnecting a device may be more dangerous than temporarily isolating it through compensating controls.

Cyber-physical security requires cooperation among security engineers, safety professionals, operations staff, vendors, and emergency planners. Recovery should be tested under realistic conditions, including loss of communications, unavailable suppliers, and degraded instrumentation.

8. Regulation, Privacy, and Professional Ethics

Cybersecurity regulation increasingly requires risk management, incident reporting, supply-chain oversight, resilience testing, and executive accountability. Requirements differ by jurisdiction and sector, so organisations must maintain a legal and regulatory obligations register. Compliance is a floor, not a complete security strategy.

Privacy principles such as purpose limitation, data minimisation, transparency, accuracy, access control, retention limitation, and accountability are particularly important for AI and surveillance technologies. Security monitoring must be proportionate and lawful. Employees should know what is monitored, why it is monitored, and how information is protected.

Ethical cybersecurity involves more than legal compliance. Professionals should consider foreseeable harm, discrimination, safety, autonomy, confidentiality, and the effects of security decisions on vulnerable groups. For example, an automated fraud model that disproportionately blocks a demographic group may be statistically efficient yet ethically and commercially unacceptable.

Incident reporting presents a governance challenge. Organisations must preserve evidence, communicate accurately, protect affected individuals, meet legal deadlines, and avoid speculation. Preparedness should include predefined decision criteria, legal advice, communications plans, and liaison with regulators and relevant authorities.

9. Workforce and Organisational Capability

Technology cannot compensate for missing competence or unclear accountability. A future-oriented workforce model combines specialists with broad security literacy across the organisation.

Important capability areas include cloud security, identity engineering, secure software development, digital forensics, privacy, AI assurance, OT security, threat intelligence, resilience planning, risk communication, and third-party management. Non-technical skills—writing, negotiation, facilitation, ethics, and business analysis—are equally important for strategic roles.

Organisations should use role-based training rather than identical annual awareness modules. Developers need secure coding and dependency management; executives need risk and crisis decision-making; procurement staff need supplier assurance; and operators need safe handling of incidents.

Workforce planning should address shortages through apprenticeships, mentoring, internal mobility, realistic exercises, managed services, and automation of low-value repetitive tasks. Outsourcing does not transfer accountability. The organisation still needs enough internal knowledge to select suppliers, challenge performance, and respond when services fail.

10. Geopolitical Risk and Systemic Exposure

Cyber risk is influenced by international conflict, sanctions, espionage, criminal markets, contested infrastructure, and dependency on foreign technologies or suppliers. Geopolitical analysis should therefore be integrated into enterprise risk management.

Relevant questions include:

• Which critical services depend on one region, provider, cable, satellite, or software ecosystem?
• Could sanctions or conflict interrupt support, updates, payments, or logistics?
• Are suppliers exposed to state pressure or legal demands?
• Could a local incident become systemic through shared cloud, identity, or software dependencies?

Resilience measures include supplier diversification where justified, contractual exit plans, offline procedures, alternative communications, tested restoration, dependency mapping, and information-sharing relationships. Diversification is not automatically safer: multiple suppliers can increase complexity and expand the attack surface. The correct decision depends on concentration risk, substitutability, switching costs, and control quality.

11. From Cybersecurity to Digital Resilience

Traditional security often emphasises prevention. Digital resilience adds the ability to absorb disruption, continue essential functions, recover reliably, and learn. A resilient organisation assumes that some controls will fail and designs for graceful degradation.

A resilience model can be organised around five capabilities:

1. Anticipate: understand threats, dependencies, scenarios, and weak signals.
2. Withstand: prevent or limit compromise through layered controls.
3. Respond: coordinate technical, operational, legal, and communication actions.
4. Recover: restore safe services using trusted systems and verified data.
5. Adapt: incorporate lessons, redesign dependencies, and improve capability.

Business continuity and disaster recovery should be integrated with cybersecurity incident response. Backups must be protected from attackers and tested for restoration. Recovery objectives should be defined with business owners. A recovery time objective specifies the targeted maximum time to restore a service after disruption; a recovery point objective specifies the maximum acceptable period of data loss. These are management requirements, not guarantees.

Emerging resilience models also emphasise adaptive capacity, diversity of suppliers and technical architectures, and the ability to operate in degraded modes. Resilience should be assessed through exercises, simulations, red-team activity, tabletop scenarios, and evidence from real incidents.

Applied Case: Northbridge Health Network

Background

Northbridge Health Network, an illustrative regional healthcare provider, operates hospitals, outpatient clinics, telemedicine services, connected medical devices, and a cloud-based patient-record platform. Its digital transformation programme aims to expand remote consultations and integrate community pharmacies.

Problem

A risk assessment identifies three major concerns: ransomware affecting clinical availability, insecure medical devices with long replacement cycles, and an AI triage tool supplied by a third party. The organisation also depends on a single cloud identity provider and has limited security engineering capacity.

Analysis

The board initially proposes purchasing an advanced detection platform. The security team demonstrates that asset inventories are incomplete, privileged accounts are inconsistently protected, and restoration tests have not included clinical workflows. Detection technology alone would not address the highest dependencies.

The AI triage tool presents additional risks. Its training data provenance is poorly documented, its outputs are not consistently reviewed by clinicians, and the supplier contract does not provide adequate incident-notification or model-change provisions. Medical-device segmentation is also insufficient, allowing some devices to communicate broadly across clinical networks.

Approach and solution

Northbridge adopts a risk-aligned roadmap:

• establish executive ownership for clinical cyber resilience;
• implement phishing-resistant authentication for privileged and remote access;
• create a clinically validated asset and dependency inventory;
• segment medical devices and restrict vendor remote access;
• protect, isolate, and regularly restore backups;
• conduct a clinical ransomware exercise;
• require AI documentation, testing, human review, model-change notification, and audit rights;
• develop alternative procedures for temporary loss of the cloud identity service;
• train clinicians, engineers, procurement staff, and executives according to role;
• introduce a metrics dashboard covering recovery performance, privileged access, critical exposure, supplier risk, and AI incidents.

Automation is introduced gradually. Low-risk enrichment of alerts is automated, while account disabling and clinical-system isolation require human approval unless predefined emergency conditions are met.

Outcome

After twelve months, Northbridge has not eliminated risk, but it has reduced concentration and improved decision quality. A recovery exercise identifies a previously unknown dependency on a pharmacy integration service, which is then added to continuity planning. The AI tool is retained only after the supplier supplies evidence of testing and the clinical governance committee approves its use.

Learning points

The case demonstrates that strategy is a portfolio of coordinated capabilities. Technology purchases are valuable only when supported by governance, identity, inventories, recovery, supplier management, workforce competence, and clinical or operational ownership. It also shows that AI governance and cyber resilience must be integrated rather than managed as separate projects.

Challenges and Limitations

Strategic cybersecurity decisions are constrained by uncertainty. Threat intelligence may be incomplete, probability estimates may be subjective, and impacts such as loss of trust or patient harm are difficult to quantify. Frameworks can encourage checklist compliance if not connected to business outcomes. Metrics may be gamed, and maturity scores may conceal weaknesses in high-impact services.

AI systems can create an illusion of objectivity. A model may be accurate on historical data but fail under changed conditions or targeted manipulation. Automation can increase the speed of both defence and error. Quantum forecasts are uncertain, while migration is expensive and technically complex. Regulation may overlap or conflict across jurisdictions. Finally, resilience investments compete with immediate delivery demands, even though their value becomes visible mainly during disruption.

These limitations reinforce the need for professional judgement, scenario analysis, independent assurance, transparent assumptions, and continuous learning.

Best-Practice Principles

1. Align security objectives with mission-critical services and stakeholder harm.
2. Assign explicit ownership for assets, risks, controls, and recovery.
3. Build foundational visibility before purchasing advanced analytics.
4. Use layered controls and assume that some controls will fail.
5. Govern AI throughout its lifecycle, including data, models, suppliers, and retirement.
6. Automate proportionately, with testing, logging, rollback, and human escalation.
7. Begin cryptographic discovery and migration planning before quantum capability becomes urgent.
8. Treat IoT and OT as safety- and availability-sensitive environments.
9. Integrate privacy, ethics, legal obligations, and security engineering.
10. Test recovery and decision-making under realistic conditions.
11. Measure outcomes, not only compliance activities.
12. Review the strategy as business, technology, threat, and geopolitical conditions change.

Chapter Summary

A contemporary cybersecurity strategy translates organisational objectives into prioritised capabilities, accountable decisions, and measurable resilience outcomes. Risk alignment requires understanding critical services, estimating exposure, selecting proportionate controls, and managing residual risk. A roadmap should sequence foundations, integration, and future-oriented capabilities rather than treating security as a collection of isolated technologies.

AI can strengthen detection and analysis, but AI systems introduce threats including poisoning, prompt injection, excessive agency, model theft, privacy leakage, and supply-chain compromise. Automation must therefore be constrained and auditable. Quantum risk requires cryptographic inventories and migration planning. IoT and OT security must account for long lifecycles, safety, availability, and operational constraints. Regulation, privacy, ethics, workforce capability, supplier concentration, and geopolitics are strategic issues rather than peripheral concerns.

Digital resilience extends prevention by emphasising anticipation, withstanding disruption, response, recovery, and adaptation. Effective cybersecurity management combines governance, technology, people, suppliers, exercises, and continuous learning.

Key Terms

Cybersecurity strategy: Coordinated choices for managing cyber risk while achieving organisational objectives.

Risk appetite: The amount and type of risk an organisation is willing to accept.

Residual risk: Risk remaining after controls are applied.

Cybersecurity roadmap: A sequenced plan of security initiatives, owners, dependencies, and measures.

Security governance: Structures and processes that direct, oversee, and assure cybersecurity.

Zero trust: A security approach that continuously verifies access rather than automatically trusting network location.

AI for cybersecurity: Use of AI to support security analysis, detection, response, or decision-making.

AI security: Protection of AI systems, their data, models, interfaces, and outputs.

Prompt injection: Manipulation of an AI system through crafted instructions or input content.

Data poisoning: Deliberate corruption of data used to train or operate an AI system.

Automation: Execution of tasks by technology with limited direct human intervention.

Cryptographic agility: The ability to replace cryptographic algorithms or keys with limited disruption.

Post-quantum cryptography: Cryptographic techniques designed to resist attacks from relevant quantum computers.

Internet of Things: Networked physical devices that collect, process, or exchange data.

Operational technology: Technology that monitors or controls physical processes.

Digital resilience: The capacity to anticipate, withstand, respond to, recover from, and adapt to disruption.

Recovery time objective: Target time for restoring a service after disruption.

Recovery point objective: Maximum acceptable period of data loss measured backward from disruption.

Supply-chain risk: Risk introduced through suppliers, software, services, components, or dependencies.

Threat modelling: Structured identification of assets, trust boundaries, threats, and mitigations.

Review Questions

Short Answer Questions

1. What is the difference between inherent risk and residual risk?
2. Why should a cybersecurity roadmap include business and service owners?
3. Name four threats specific to AI systems.
4. Why is cryptographic agility important for quantum readiness?
5. What are the five capabilities in the digital resilience model described in this chapter?

Long Answer Questions

1. Explain how an organisation can develop a risk-aligned cybersecurity strategy from current-state assessment to roadmap measurement.
2. Compare AI used for cybersecurity with the security of AI systems, including governance requirements for each.
3. Discuss the challenges of applying conventional IT security practices to IoT and OT environments.
4. Evaluate the role of regulation, privacy, ethics, and professional accountability in cybersecurity strategy.
5. Explain how workforce capability, supplier concentration, and geopolitical risk influence digital resilience.

Analytical / Application Questions

1. A university plans to deploy an AI admissions assistant that can access applicant records and send messages. Develop a threat model and recommend governance and technical controls.
2. A manufacturing company relies on one cloud provider, legacy industrial controllers, and a global software supplier. Design a three-horizon cybersecurity and resilience roadmap.
3. An organisation estimates that a major cyber incident has a 0.15 annual probability and an impact of $800,000. Calculate the simplified expected loss, then explain why the result alone cannot determine the security budget.

Multiple Choice Questions with Answers

Question 1

Which statement best describes residual risk?

A. Risk before any controls are applied

B. Risk remaining after controls are applied

C. Risk that has been transferred to an insurer

D. Risk that has no possible impact

Correct Answer: B. Risk remaining after controls are applied

Question 2

What should generally precede the adoption of advanced AI-driven security analytics?

A. Eliminating all human review

B. Reliable asset inventories, identity controls, and data quality

C. Removing incident-response procedures

D. Increasing the number of untested automated actions

Correct Answer: B. Reliable asset inventories, identity controls, and data quality

Question 3

Which is an example of prompt injection?

A. Replacing an expired encryption certificate

B. Crafting input that attempts to override an AI application’s intended instructions

C. Segmenting a medical-device network

D. Testing a disaster-recovery backup

Correct Answer: B. Crafting input that attempts to override an AI application’s intended instructions

Question 4

What is the primary purpose of cryptographic agility?

A. To prevent all phishing attacks

B. To replace cryptographic algorithms with limited disruption

C. To increase the physical size of encryption keys automatically

D. To eliminate the need for key management

Correct Answer: B. To replace cryptographic algorithms with limited disruption

Question 5

Why do OT environments require special cybersecurity treatment?

A. They never contain digital systems

B. Safety, availability, and deterministic operation may take priority over confidentiality

C. They are always disconnected from every network

D. Their software can always be patched immediately

Correct Answer: B. Safety, availability, and deterministic operation may take priority over confidentiality

Question 6

Which action is most appropriate for a high-consequence automated security decision?

A. Remove all audit logging

B. Require safeguards and human approval or predefined emergency criteria

C. Allow any model output to change production systems

D. Disable rollback capability

Correct Answer: B. Require safeguards and human approval or predefined emergency criteria

Question 7

An event has probability 0.15 and impact $800,000. Using EL = P × I, what is the simplified expected loss?

A. $12,000

B. $120,000

C. $680,000

D. $800,000

Correct Answer: B. $120,000

Question 8

Which activity is most directly associated with AI security governance?

A. Ignoring model changes after deployment

B. Documenting data provenance, testing, oversight, and incident response

C. Giving every AI agent unrestricted privileges

D. Using only historical accuracy as an assurance measure

Correct Answer: B. Documenting data provenance, testing, oversight, and incident response

Question 9

What does a recovery point objective specify?

A. The target time to restore a service

B. The maximum acceptable period of data loss

C. The number of employees in a response team

D. The maximum age of a security policy

Correct Answer: B. The maximum acceptable period of data loss

Question 10

Which statement best reflects a mature cybersecurity strategy?

A. Compliance checklists alone guarantee security

B. All risks can be eliminated through technology

C. Security investment is connected to critical services, accountable owners, and resilience outcomes

D. Cybersecurity is solely the responsibility of the IT department

Correct Answer: C. Security investment is connected to critical services, accountable owners, and resilience outcomes