Information Security Policy21%
Business Continuity Plan53%
Acceptable Use Policy15%
Incident Response Plan7%
Other (share below)1%
Always required – Security must formally review and approve every change request.8%
Required for security-impacting changes – Security reviews only changes flagged as having potential security implications. Please comment : Who decides which changes require security review and which do not ? Is this determination manual or automated? How do you avoid gaps or oversights in this process ?84%
Not required – Security does not review changes submitted CAB/RAB by other teams. 8%
Risk-based or automated – Security involvement is determined by a tiered model or automated risk scoring within ITSM.
Yes70%
No29%
No selling.
No recruiting.
No self promotion.
Rules of EngagementFAQsPrivacy
© 2025 Gartner, Inc. and/or its affiliates. All rights reserved.
The answer depends on why I was hired
What’s the biggest and most costly problem I was hired to resolve?
Did they have a Ransomeware situation? Then Security
Did they recently have a big disaster and it took to long to recover? Then business continuity
From experience with acquisitions, both Security and Business Continuity are the top issues almost all of the time