Which components typically constitute an IT security governance framework for a government agency?

• A. Marketing strategy, public relations, media contacts, event planning
• B. Policies, risk management, access controls, incident response, training, backups/recovery, monitoring
• C. Payroll processing, vendor invoices, budget approvals, travel policies
• D. Physical office layout, seating charts, parking

Answer: (B)

The main idea being tested is what elements make up a structured IT security governance approach for a government agency. A solid governance framework coordinates how information security is governed across people, processes, and technology. The right set includes policies that establish the rules and responsibilities, risk management to identify and prioritize threats and the controls needed to address them, access controls to ensure only authorized individuals can view or modify data, incident response to detect, contain, and recover from security events, training to make sure staff understand and follow security practices, backups and recovery to preserve data and restore operations after incidents, and monitoring to continuously observe systems for security posture and compliance.

These pieces fit together to create an auditable, repeatable approach that aligns security with organizational goals and regulatory requirements, which is essential for government operations. The other options lean toward marketing, administrative finances, or physical workspace concerns, rather than the comprehensive set of governance elements that protect information and ensure continuity.