Which entities should own cybersecurity governance across IT, risk, and compliance functions in an organization?

• A. Board and executive management via a CISO or equivalent, with clear roles for IT, risk management, compliance, and internal audit to provide assurance.
• B. IT Department Only
• C. Compliance Function Only
• D. External Security Consultants

Answer: (A)