Which Cybersecurity Policy Deficiency Is Most Critical?

CRISC By islever Editorial Last updated

Short answer

D The policy has not been approved by the organization's board.

Question

Which of the following deficiencies identified during a review of an organization’s cybersecurity policy should be of MOST concern?
  1. The policy has gaps against relevant cybersecurity standards and frameworks.
  2. The policy lacks specifics on how to secure the organization's systems from cyberattacks.
  3. The policy has not been reviewed by the cybersecurity team in over a year.
  4. The policy has not been approved by the organization's board. Correct Answer

Key Takeaways

Tests hierarchical policy governance, where candidates often fall into the trap of prioritizing technical control details over mandatory executive endorsement.

This CRISC question emphasizes the foundational role of executive governance in cybersecurity policies. Industry consensus confirms that missing board approval poses the greatest risk, as it directly undermines policy authority, funding, and organizational compliance.

Common mistake: Option B is frequently selected due to its technical focus, but detailed control specifications are meaningless without leadership backing to enforce them or allocate resources.

Expert Analysis

Why the Answer Is Correct

Board approval establishes the formal mandate required for any cybersecurity policy to function effectively. It aligns security objectives with business strategy, secures essential funding, and grants enforcement authority across departments. In CRISC risk assessments, governance failures consistently rank above operational or technical gaps because they invalidate the entire control environment.

Why the Other Options Are Wrong

Gaps against industry standards (A) and missing technical specifics (B) are addressable through remediation plans once leadership provides direction and budget. Similarly, infrequent reviews (C) indicate poor maintenance but do not strip the policy of its foundational legitimacy. Without executive sponsorship, even perfectly documented technical controls cannot be implemented or sustained.

Community Comment Notes

Users consistently highlight that board approval demonstrates top-level accountability and commitment to cybersecurity priorities [1]. Several commenters stress that executive endorsement is required to overcome departmental resistance and ensure cross-functional compliance [3]. The discussion reinforces ISACA's principle that governance must precede all technical control design.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always evaluate policy deficiencies through the lens of governance and strategic alignment before analyzing technical details. When faced with choices between executive sponsorship, funding, or legal compliance versus procedural gaps, prioritize the option that enables organizational enforcement.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Joloms 👍 2
    ll of the deficiencies mentioned are concerning, but the one that should be of MOST concern is: D. The policy has not been approved by the organization's board. Approval by the organization's board is crucial because it signifies high-level acknowledgment and commitment to the cybersecurity policy. Without board approval, the policy may lack the necessary authority, resources, and enforcement mechanisms to be effectively implemented throughout the organization. This deficiency indicates a fundamental gap in governance and oversight, which can undermine the organization's ability to effectively address cybersecurity risks.
  2. Sara98 👍 1 Answered D
    Board approval is crucial for demonstrating the organization's commitment to cybersecurity and ensuring that the policy aligns with the overall business strategy. A policy that has not been approved by the board may not be fully implemented or supported by senior management, which can weaken its effectiveness.
  3. d3a225d 👍 1 Answered D
    D. The policy has not been approved by the organization's board.
  4. Jecalyn 👍 1 Answered D
    policy has not been approved should be the MOST concern

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Why Test a Modified Disaster Recovery Plan?

S-grade

Which Process Determines Threat Relevance for Risk Scenarios?

S-grade

How to Best Prove Implemented Controls Reduce IT Risk?

S-grade

Best Approach to Assess Identified Risk Events in Projects?

S-grade

Practice All CRISC Questions

Access 332 questions with complete answers and detailed explanations.

View Full CRISC Practice Test →

← Back to CRISC Study Guide