Prática ISACA CISM

A newly hired security manager finds that the security program has no documented mission, no board-level sponsor, and no formal alignment to the company's strategic goals, even though individual technical controls (firewalls, EDR, MFA) are well implemented. What is the most fundamental governance gap this describes?

• AMissing security governance: the absence of a documented strategy, executive sponsorship, and business alignment, regardless of technical control maturity
• BA missing firewall rule
• CAn unpatched vulnerability
• DA missing backup schedule