Which of the following is NOT a primary objective of a district information security program?

• A. Provide high-speed internet access to students and staff
• B. Protect data, ensure availability and integrity, manage cyber risk, and comply with applicable laws and regulations
• C. Ensure data backups and disaster recovery capabilities
• D. Manage user access controls to systems and data

Answer: (B)

The main idea is to separate what an information security program aims to protect and enable, from general IT service goals. An information security program is built around protecting data, ensuring its availability and integrity, managing cyber risk, and complying with applicable laws and regulations. It also includes ensuring data backups and disaster recovery capabilities, and implementing controls for who can access systems and data. Providing high-speed internet access, while essential for learning and operations, is an IT service objective focused on connectivity and bandwidth rather than safeguarding information. That makes it not a primary objective of the security program, while the other items align with security goals.