Match each cybersecurity governance participant with their primary role: Participants: 1. Board of Directors 2. Cybersecurity Leader (CISO) 3. Internal Audit 4. Operational Business Units Roles: A. Carries out day-to-day security policies and practices within routine business workflows B. Conducts independent assessments of internal controls, governance, and regulatory compliance C. Directs enterprise security strategy, operations, and risk reporting across the organization D. Provides strategic governance and high-level oversight of major organizational cybersecurity risks

### The pairs | Item | Matches | Why | |---|---|---| | Board of directors | Provides oversight of significant cybersecurity risks | The board's role is governance and oversight, not day-to-day technical operation. | | Cybersecurity leader | Directs or coordinates the security function and reports through an established structure | Clear reporting helps cybersecurity concerns reach decision-makers. | | Internal audit | Checks accountability and compliance and can identify areas for improvement | The material identifies audits as a way to check whether policies and responsibilities are followed. | | Operational departments | Carry out assigned security responsibilities in their work | Cybersecurity is not solely an information technology concern; departments contribute to the risks and operations they manage. | ### Terms - **Internal audit**: An organizational review used to examine governance, controls, or compliance. - **Operational department**: A business unit responsible for part of the organization's day-to-day work. ### Remember Oversight, security leadership, independent checking, and operational execution are related but distinct roles.