According to the course material, who should establish the cybersecurity governance framework and communicate its importance throughout the organization?

### Why this is right The course assigns this responsibility to executive leadership, including the chief executive officer and board of directors. Their direction communicates that cybersecurity is an organizational concern. ### The concept Leadership establishes the framework and sets expectations. Other groups, including the information technology department and other departments, contribute to carrying out security responsibilities. Leadership does not mean that executives perform every operational security task themselves. ### The other options - **B. Only the organization's external suppliers**: Suppliers may be relevant to supply-chain security, but they do not establish the company's governance framework. - **C. Only individual employees, without executive direction**: This omits the leadership role identified in the course. - **D. A security product vendor**: A vendor can supply technology, but organizational governance belongs to the organization. ### Terms - **Chief executive officer**: The senior executive who leads an organization. ### Remember Executives establish direction; organizational teams carry out assigned responsibilities.