Which of the following is NOT listed as part of Understanding the business?

• A. Implement patch management
• B. Understand where you've been
• C. Understand macro factors that affect business
• D. Understand and develop relationships with key stakeholders

Answer: (A)

Understanding the business centers on grasping how the organization operates, why it makes sense to allocate resources to security, and how external and internal factors shape risk and priorities. It includes learning from the past to inform decisions, recognizing macro factors that affect the business (like regulations, market conditions, and supply chains), and building and maintaining relationships with key stakeholders who influence funding and direction.

Patch management, by contrast, is a technical security control focused on keeping software up to date and mitigating vulnerabilities. While essential to overall security, it does not illuminate business context or stakeholder dynamics, so it isn’t listed under Understanding the business. The other items fit because they involve historical insight, external factors, and stakeholder relationships that drive business-aligned security decisions.