問題文
A CISO wants a single sentence that captures why the model is a strategy and not a product category. Which formulation matches the published position?
選択肢
- It should be realized as a true strategy that evolves over a long-term horizon, not merely a few years, which is why advocating for the latest enabling technology would be short-sighted.
- It qualifies as a strategy because the standard defines it as a plan rather than as an implementation, and a plan of that kind cannot be purchased from a vendor.
- It counts as a strategy because no single product can cover all five maturity pillars, so the organization must integrate several.
- It is a strategy because the maturity model explicitly excludes incident response, logging specifics, and recovery, which means no product that addresses only the included scope could deliver a complete posture.