The correct answer is D because a business case for an information security initiative should first be based on risk. Conducting a risk assessment identifies the threats, vulnerabilities, likelihood, business impact, regulatory exposure, control gaps, and potential consequences that justify the initiative. In a highly regulated environment, legal and compliance obligations are important inputs, but the business case should still be driven by risk to the organization, including compliance risk. Benchmarking against competitors may provide context, but it does not define the organization's specific need. Consulting legal counsel may be necessary to interpret regulatory obligations, but it is not as complete as a risk assessment for developing a business case.
A feasibility study is useful after the need and risk have been established. CISM emphasizes that security investments should be risk-based, business-aligned, and cost-justified. Therefore, the first step is to conduct a risk assessment to support the business case.
Reference: CISM Information Risk Management; risk assessment, business case development, regulatory risk, cost justification, and security investment principles.