PRISM Topic Areas of Coverage provide focus on which aspect of information security program management?

• A. The first 8 topic areas focus on the strategic aspect of info security program management
• B. They focus on operational procedures
• C. They focus on hardware procurement
• D. They focus on personnel training

Answer: (A)

The first eight PRISM topic areas are focused on shaping and guiding the information security program at a strategic level. They cover how security goals align with the organization’s mission, establish governance and policy, set risk tolerance, plan resources and budgets, and define how the program will be measured and improved over time. This strategic view provides direction for oversight, decision-making, and long-term roadmaps that steer the entire program.

In contrast, the other options describe more tactical or execution-oriented activities—operational procedures are about how tasks are performed, hardware procurement concerns acquiring technology, and personnel training focuses on developing people’s skills. While these are important, they reflect implementation and capability-building rather than the overarching program direction that the first eight topics establish.