Which activity is part of the ongoing improvement cycle in a security program?

• A. Audit, analyze gaps, update plan, and repeat
• B. Hire staff, assign duties, monitor, report
• C. Plan, budget, deploy, retire, train
• D. Conduct annual performance reviews of security staff

Answer: (A)

Continual improvement in a security program comes from an ongoing loop of verifying what you have, identifying gaps, updating the plan, and starting the cycle again. Auditing shows how well current controls work and what’s actually in place. Analyzing gaps turns those findings into prioritized fixes, so you know where to focus resources. Updating the plan implements those fixes—adjusting policies, controls, and investments. Then you repeat the process, continually tightening security as threats evolve and lessons are learned.

While tasks like staffing, budgeting and deploying, or annual performance reviews are important for running security, they don’t by themselves constitute the ongoing improvement cycle. They are components or periodic activities, whereas the described sequence creates a repeating loop that drives the program forward.