Which set best describes the key components of IT security governance?

• A. User training only and firewall purchases.
• B. Governance of information security objectives, risk assessment, policies, controls (access control, encryption), incident response, monitoring, and assurance.
• C. Hardware inventory and software licensing exclusively.
• D. External audits only, with no internal governance.

Answer: (B)

IT security governance is about steering security efforts through a structured framework that ties security objectives to business risk. The best choice covers all the essential elements: governance of information security objectives, risk assessment to understand threats and impacts, policies to set expectations, and controls (such as access control and encryption) to enforce those policies. It also includes incident response to handle events, ongoing monitoring to track effectiveness, and assurance to provide confidence to management and auditors. This combination ensures that security activities are aligned with business goals, prioritized by risk, and continuously evaluated and improved. The other options are too narrow or incomplete: focusing only on training and firewall purchases misses governance and risk management; concentrating only on hardware inventory and software licensing is asset management rather than governance; relying solely on external audits ignores the need for internal governance, ongoing monitoring, and improvement.