What are the two critical security functions that an organization's senior management needs to address?

What will be an ideal response?

Senior management in an organization needs to address two critical security functions: security policy and risk management. Considering the first, senior management must establish company-wide security policies. Take, for example, a data security policy that states the organization's posture regarding data it gathers about its customers, suppliers, partners, and employees. At a minimum, the policy should stipulate: what sensitive data the organization will store, how it will process that data, whether data will be shared with other organizations, how employees and others can obtain copies of data stored about them, and how employees and others can request changes to inaccurate data. The specifics of a policy depend on whether the organization is governmental or nongovernmental, on whether it is publically held or private, on the organization's industry, on the relationship of management to employees, and other factors. The second senior management security function is to manage risk. Risk cannot be eliminated, so to manage risk means to proactively balance the trade-off between risk and cost. This trade-off varies from industry to industry and from organization to organization.