Section: INFORMATION SECURITY GOVERNANCE
Explanation:
Any planning for information security should be properly aligned with the needs of the business. Technology should not come before the needs of the business, nor should planning be done on an artificial timetable that ignores business needs.

The discovery of a Trojan installed on a system's administrator's laptop is highly significant since this may mean that privileged user accounts and passwords may have been compromised. The other choices, although important, do not pose as immediate or as critical a threat.

Section: INFORMATION SECURITY GOVERNANCE
Explanation:
Management is primarily interested in security solutions that can address risks in the most cost-effective way.
To address the needs of an organization, a business case should address appropriate security solutions in line with the organizational strategy.