What is the basis of a security management plan?

• A. Security risk assessment.
• B. Information collection.
• C. Security policy development.
• D. Incident response planning.

Answer: (B)

Information collection provides the factual foundation for a security management plan. To protect assets effectively, you must first know what you’re protecting, where it resides, how it’s used, who has access, what threats and vulnerabilities exist, what controls are already in place, and what incidents have occurred. This gathered data informs how risk is assessed, which in turn shapes the policies you establish and the incident response procedures you develop. Without solid information, the plan would be built on guesses rather than reality, leading to misallocated resources and ineffective protections. So, collecting comprehensive, relevant information is the basis for creating a realistic and effective security management plan.