ISC2 Governance, Risk and Compliance (CGRC) Practice Question

The described committee is carrying out governance. Governance establishes direction and oversight, aligns information-security efforts with business objectives, and holds leaders accountable for outcomes. By reviewing metrics against strategic goals and directing corrective actions, the committee exercises that oversight function. Risk management would focus on identifying and treating specific risks, compliance would emphasize adherence to external requirements, and incident response coordination concerns reacting to security events-none of which are the primary purpose of this meeting.