Which statement best describes the purpose of cybersecurity governance?

### Why this is right Governance establishes how cybersecurity decisions are directed, assigned, and reviewed. Its purpose includes connecting security work to business priorities, managing risk, and meeting applicable obligations. ### The concept Governance is an organizational framework, not a single technology or a promise that incidents cannot happen. It includes policies, processes, responsibilities, and oversight. Strong governance helps leaders make informed choices about security investments and helps employees understand their responsibilities. ### The other options - **B. It replaces business planning with technical decisions made only by the information technology department.** Governance connects security to business planning and involves responsibility beyond the technical department. - **C. It guarantees that an organization will never experience a cyber incident.** Governance can improve risk management and resilience, but it cannot eliminate all risk. - **D. It focuses exclusively on purchasing security software.** Technology can support security, but governance also covers people, processes, accountability, and compliance. ### Terms - **Cybersecurity governance**: The structures and processes used to direct and control an organization’s cybersecurity work. - **Compliance**: Meeting applicable legal, regulatory, contractual, or organizational requirements. ### Remember Governance directs security decisions; it does not guarantee that attacks will never succeed.