Which term describes the overall framework for structuring information security across an organization?

Which term describes the overall framework for structuring information security across an organization?

• A. Information Security Policies
• B. Network Security Zoning
• C. Enterprise Information Security Architecture (EISA)
• D. Internet DMZ

Answer: (C)

An overarching framework that coordinates security controls, governance, risk management, and technology across the entire organization is essential to ensure consistency and alignment with business goals. This is what Enterprise Information Security Architecture provides. It creates a common structure, vocabulary, and standards that guide how people, processes, and technology work together to protect information. It covers strategy, architecture, and implementation, not just rules or isolated network details. By having this architecture, an organization can map security requirements to business processes, ensure interoperability of controls, and manage risk and compliance across the enterprise. Information security policies are the rules that describe what must be done, but they don’t define the full structural framework. Network security zoning focuses on segmentation and controlling traffic within the network, which is a design technique, not the entire enterprise-wide framework. An Internet DMZ is a specific network boundary for externally exposed services, again a tactical element rather than the guiding architecture for the whole organization.

An overarching framework that coordinates security controls, governance, risk management, and technology across the entire organization is essential to ensure consistency and alignment with business goals. This is what Enterprise Information Security Architecture provides. It creates a common structure, vocabulary, and standards that guide how people, processes, and technology work together to protect information. It covers strategy, architecture, and implementation, not just rules or isolated network details. By having this architecture, an organization can map security requirements to business processes, ensure interoperability of controls, and manage risk and compliance across the enterprise.

Information security policies are the rules that describe what must be done, but they don’t define the full structural framework. Network security zoning focuses on segmentation and controlling traffic within the network, which is a design technique, not the entire enterprise-wide framework. An Internet DMZ is a specific network boundary for externally exposed services, again a tactical element rather than the guiding architecture for the whole organization.