Which statement best describes a cybersecurity strategy?

### Why this is right A strategy sets the organization’s overall approach to protecting its assets and reducing risk. It guides related decisions about policies, controls, training, and monitoring. ### The concept A cybersecurity strategy is broader than a tool list or an incident report. It links security activity to organizational assets and needs, and it changes when business requirements or threats change. Implementation includes selecting controls and helping employees use them correctly. Monitoring then provides evidence about whether the plan still works. ### The other options - **A list of attacks that have already happened**: that is an incident history, not a plan for securing assets. - **A one-time installation of security software**: a tool may support a strategy, but installation alone does not address people, processes, or ongoing review. - **A document concerned only with employee discipline**: rules for conduct may be part of policy, but a strategy also addresses technical and organizational protections. ### Terms - **Asset**: something of value that an organization needs to protect. - **Control**: a safeguard intended to reduce risk. ### Remember A strategy is an ongoing plan, not a one-time security purchase.