What components support ongoing assurance in IT security governance?

• A. Ignoring risk assessments.
• B. Only annual external audits.
• C. Security governance is only about encryption.
• D. Continuous monitoring, policy enforcement, incident response, and assurance activities.

Answer: (D)

Ongoing assurance in IT security governance comes from a continuous, integrated set of activities that keep security controls effective over time rather than a one-off effort. Continuous monitoring tracks security conditions and control performance in real time, so you can spot drift, emerging risks, or failed controls as they happen. Policy enforcement ensures that the organization’s security rules are actually applied across systems, applications, and users, maintaining consistent adherence rather than letting gaps develop. Incident response provides a structured way to detect, contain, and learn from security events, reducing impact and driving improvements. Assurance activities—such as internal and external audits, assessments, testing, and metrics—supply evidence about control effectiveness and help guide ongoing enhancements.

These pieces together form a complete approach to ongoing assurance. In contrast, ignoring risk assessments removes the context and prioritization that guide where to focus monitoring and controls. Relying only on annual external audits misses changes and new threats that occur between audits. And treating security governance as solely about encryption overlooks the broad range of controls and practices needed to manage risk, such as access control, patch management, and incident handling.