According to the Corporate Governance Task Force (CGTF),in order to build programs suited to their needs,organizations should do all but which of the following?
A) Create and execute a plan for punitive action for employees who fail to resolve information security deficiencies
B) Use security best practices guidance, such as ISO 17799, to measure information security performance
C) Establish plans, procedures, and tests to provide continuity of operations
D) Develop plans and initiate actions to provide adequate information security for networks, facilities, systems, and information

Question

Quizplus · Accepted Answer

The other options (B, C, and D) all suggest proactive measures that organizations should take to improve their information security programs. Option A, on the other hand, suggests a punitive approach that focuses only on consequences for failure, rather than positive actions to prevent failure. Punitive measures may be necessary in some circumstances, but they are not sufficient on their own to promote effective security practices.

According to the Corporate Governance Task Force (CGTF),in Order to Build