Which item is contained in the Program Management Overview?

• A. Information security program plan (pm)
• B. Disaster recovery plan
• C. Incident response procedures
• D. Business continuity strategy

Answer: (A)

The main concept here is how a security program is framed at a management level. The Program Management Overview describes the high-level governance and planning for the information security program, including its objectives, scope, roles and responsibilities, and how risk will be managed. The information security program plan is the overarching document that defines these elements—policies, control baselines, governance structures, and how success will be measured—so it belongs in the Program Management Overview. The other items are specific operational plans: a disaster recovery plan focuses on restoring IT after a major outage; incident response procedures guide how to detect and handle security incidents; and a business continuity strategy outlines maintaining critical functions during disruptions. Those are specialized plans that support the program but do not reside in the overview itself.