The PRIMARY objective for information security program development should be:

 Objective of Information Security Programs:

The primary objective of an information security program is to manage risks in a manner that aligns with business goals and minimizes the impact of potential security incidents. This involves identifying risks, implementing appropriate controls, and ensuring that security measures are integrated into the organization’s overall risk management framework.

 Risk-Centric Approach:

The EC-Council emphasizes that information security programs should not merely focus on compliance or deploying the latest tools but on reducing risks that could disrupt business processes or cause harm to assets.

 Alignment with Business Continuity:

While strategic alignment with business continuity requirements (Option B) is critical, it is part of the broader objective of reducing the overall impact of risks on the business.

 References:

This is highlighted in the EC-Council’s emphasis on aligning security initiatives with business strategies while prioritizing risk mitigation.