the answers should be one page for all them.

1. What is the difference between security governance and IT security governance? We already have an IT security governance program; why is this not sufficient? 2. How does security governance differ from other governance programs (such as financial governance) that currently exist within Acme? 3. One of our Board members asked if we were following the CIA Triad or the Parkerian Hexad. I'd never heard of the latter. What is it, and should we adopt it? 4. What should be more important: security or the business? Should they be equal? 5. How do we ensure that our security program is aligned with business objectives