Which of the following international standards can be BEST used to define a Risk Management process in an organization?

Scenario: An organization has recently appointed a CISO. This is a new role in the organization and it signals the increasing need to address security consistently at the enterprise level. This new CISO, while confident with skills and experience, is constantly on the defensive and is unable to advance the IT security centric agenda.
Which of the following is the reason the CISO has not been able to advance the security agenda in this organization?

Providing oversight of a comprehensive information security program for the entire organization is the primary responsibility of which group under the InfoSec governance framework?

Risk appetite is typically determined by which of the following organizational functions?

Which of the following organizations is typically in charge of validating the implementation and effectiveness of security controls?