Which are the key components of a robust information security program?

• A. Access controls, encryption, auditing, and incident response.
• B. Firewalls, antivirus software, patch management, and SOC monitoring.
• C. User training, incident containment, and physical security.
• D. Data backup, data retention schedules, and DRP only.

Answer: (A)

A robust information security program rests on preventing unauthorized access, protecting data, maintaining accountability, and having a clear plan to respond to incidents. Access controls limit who can reach systems and what they can do, reducing the risk of improper actions or data exposure. Encryption keeps data unreadable if it’s accessed without authorization, protecting confidentiality even when systems are imperfectly guarded. Auditing creates a trail of events and actions, helping detect unusual activity and providing evidence for investigations. Incident response offers a prepared, structured process to detect, contain, eradicate, recover from, and learn from security events, minimizing impact and improving resilience over time.

Together these elements provide prevention, detection, and response across people, processes, and technology, making them the most comprehensive set among the options. The other choices, while containing useful pieces, fall short of delivering a full, balanced program: they either emphasize only technology and monitoring, or focus on training or recovery without addressing access control, data protection, and auditing, or zero in on backups and DRP without covering broader governance and incident handling.