How can security integrate with enterprise risk management (ERM)?

• A. Work independently of ERM
• B. Align security objectives with organizational risk appetite, participate in risk assessments, and report security risks at the ERM level
• C. Focus only on physical security
• D. Limit reporting to the IT department

Answer: (B)

Integrating security with ERM means bringing security into the same framework used for managing all organizational risks. The best approach is to align security objectives with the organization's risk appetite, ensuring the security program targets residual risk in line with what leadership is willing to accept. Security professionals should actively participate in risk assessments alongside other risk owners, contributing expertise on threats, vulnerabilities, and controls, and using a common risk framework to help prioritize risks. Finally, security risks should be reported at the ERM governance level so executives can see security as part of overall risk exposure, allocate resources, and drive remediation across business units. This prevents security from becoming a silo, which can lead to misaligned priorities and blind spots. Limiting focus to physical security or restricting reporting to the IT department ignores enterprise-wide risk and undermines governance and informed decision-making.