Does your organization regularly review and adjust cybersecurity risk strategies that may be impeding business operations or innovation?

This question assesses whether the organization maintains a balance between security controls and business objectives. Security measures that are too restrictive can hinder productivity, slow innovation, or create workarounds that may introduce new vulnerabilities. Regular review ensures that security controls remain appropriate and proportional to the risks they address while supporting business goals. Evidence could include documentation of periodic risk strategy reviews, meeting minutes from security and business leadership discussions, or change logs showing adjustments to security controls based on operational impact assessments.