An effective cybersecurity governance framework encompasses strategic oversight of both supply-chain risk management and incident response planning.

### Why this is right The governance elements on the course slide explicitly include supply-chain security and incident response planning. Both belong alongside risk management, training, monitoring, and other organizational practices. ### The concept Supply-chain security concerns cybersecurity risks connected to suppliers and related relationships. Incident response planning prepares the organization to react in an organized way when a cyber incident occurs. They address different needs, but each contributes to the governance program. ### The other options - **False**: This would contradict the listed governance elements. ### Terms - **Incident response planning**: Preparing how an organization will respond to cyber incidents. - **Supply-chain security**: Managing cybersecurity concerns connected to suppliers and the supply chain. ### Remember Governance covers both preparedness for incidents and risks involving external suppliers.