Which option best completes the statement about the Cybersecurity Strategy annex in the Program Protection Plan?

Which option best completes the statement about the Cybersecurity Strategy annex in the Program Protection Plan?

• A. To document the cybersecurity posture
• B. To document the cybersecurity strategy within the Program Protection Plan
• C. To establish the system safety plan
• D. To define the testing procedures

Answer: (B)

The main idea here is understanding the purpose of the Cybersecurity Strategy annex inside the Program Protection Plan. This annex is meant to capture the approach the program will take to achieve cybersecurity goals, turning policy into a concrete strategy. It outlines objectives, the selected controls, roles and responsibilities, funding, and milestones that guide cybersecurity activities throughout the program’s life cycle. It focuses on how security will be pursued, not the current state of security (posture) or the execution details of safety or testing. Documenting the cybersecurity strategy within the Program Protection Plan provides a centralized, official reference for how security will be implemented, measured, and updated, ensuring alignment with higher-level requirements and risk tolerance. The other options describe items that belong in different areas: a current cybersecurity posture is a status within metrics, the system safety plan is a separate safety-focused document, and testing procedures belong in the testing or verification sections rather than the strategy annex.

The main idea here is understanding the purpose of the Cybersecurity Strategy annex inside the Program Protection Plan. This annex is meant to capture the approach the program will take to achieve cybersecurity goals, turning policy into a concrete strategy. It outlines objectives, the selected controls, roles and responsibilities, funding, and milestones that guide cybersecurity activities throughout the program’s life cycle. It focuses on how security will be pursued, not the current state of security (posture) or the execution details of safety or testing.

Documenting the cybersecurity strategy within the Program Protection Plan provides a centralized, official reference for how security will be implemented, measured, and updated, ensuring alignment with higher-level requirements and risk tolerance. The other options describe items that belong in different areas: a current cybersecurity posture is a status within metrics, the system safety plan is a separate safety-focused document, and testing procedures belong in the testing or verification sections rather than the strategy annex.