1
Leadership And Organizational Management
hard
A global manufacturing company has a federated governance model in which each regional business unit owns its own security budget and risk register. The corporate CISO is accountable to the board for enterprise-wide risk but has no direct authority over regional security spending. The board has asked the CISO to produce one consolidated risk view that can be audited. Which action should the ISSMP take FIRST to establish an effective enterprise-wide security governance structure?