Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CASP+ > 2 - Security Policies and Procedures > Flashcards

2 - Security Policies and Procedures Flashcards

1
Q

Internal and external changes force organizations to evolve on what levels?

A

operation, tactical, and strategic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are security policies?

A

documents that provide the foundation for organization security goals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Policies created by organizations are a reflection of what?

A

The external laws and regulations that apply to the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does policy life cycle management involve?

A

the creation, usage, and retirement of policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does performing a risk assessment identify?

A

risks to organizational assets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What should be used to guide policy creation?

A

policy templates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Where should policy input be sought?

A

from executives and other stakeholders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What should be established for policy violations?

A

penalties

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

To whom should organizational policies be published?

A

all employees in the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The organization should ensure staff members do what when a policy is published?

A

read, understand, and sign the policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What should be used to enforce policies whenever possible?

A

technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Who should be educated about organizational policy contents?

A

organizational staff

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How often should policy reviews be scheduled?

A

annually or semi-annually

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When should a policy be retired?

A

When it’s no longer applicable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Organizational policies can focus on what?

A

all aspects of an organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

System-specific policies focus on what?

A

specific computers or network systems, and the necessary security controls that protect them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Issue-specific policies focus on what?

A

specific organizational issues such as department issues, business products, processes, and others

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Regulatory policies ensure that an organization does what?

A

follows the legal requirements of compliance law

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Advisory polices do what?

A

provide strong recommendations or reminders for employees to consider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Informative policies do what?

A

gentle recommendations or reminders for employees to consider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Standards are required elements regarding what?

A

the implementation of controls or procedures in support of a policy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Guidelines do what?

A

specify optional and recommended security controls or processes to be followed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a process?

A

a predictable series of steps needed to achieve and objective

24
Q

What are procedures?

A

operation-level, step-by-step details on how to achieve specific business processes

25
Q

What are baselines?

A

point-in-time measurements of what we agree is the acceptable level or normal performance

26
Q

Policies need to be consulted and periodically revised due to what types of changes to the business?

A

new business, technologies, environmental changes, regulatory requirements, and emerging risks

27
Q

Policies are often driven by a combination of what requirements?

A

internal and external requirements

28
Q

The security requirements of policies are often best described by whom?

A

other departments within your organization - including human resources, legal, management, etc

29
Q

Security’s relationships with other business units and utilization of their skill sets are vital to what?

A

the success of an organization’s security program

30
Q

A documented process of determining the prioritization of responses to threats:

A

risk assessment

31
Q

A business impact analysis does what?

A

document the various risks to an organization and the resulting impact from disasters should those risks be realized

32
Q

What are interoperability agreements?

A

a board category of agreements that include data, technology, and communication sharing requirements between two or more organizations

33
Q

What are interconnection security agreements?

A

specialized agreements between organizations that have connected IT systems to document the security requirements associated with the interconnection

34
Q

What are memorandums of understanding?

A

legal documents used to describe a bilateral agreement between parties

35
Q

What is a service level agreements?

A

an agreement negotiated between parties detailing the expectations between a customer and a service provider

36
Q

What is an operating level agreement?

A

an internal document that defines the relationships between internal parties to support business activities

37
Q

What is a nondisclosure agreement?

A

an agreement between parties defining and establishing the rules for which information can be shared

38
Q

What is a business partnership agreement?

A

a type of legal agreement between partners establishing the terms, conditions, and expectations of the relationship

39
Q

What is a master service agreement?

A

an all-encompassing agreement between multiple organizations that serves as the building block for future agreements, transactions, and business documents

40
Q

When working with other businesses, formal documentation requests and security requirements should be included in what?

A

the contract with the other business

41
Q

Requests for proposal accomplish what goals?

A
  • informs potential vendors of a product or service being sought
  • provides specific details on what the organization wishes to purchase
  • provides a basis from which to evaluate interested vendors
42
Q

What does a Request for Quote do?

A

further restricts the list of companies that will receive the full request by asking for price ranges for services or products

43
Q

A Request for Information is issued for what purpose?

A

to seek information regarding specific products or services in the marketplace

44
Q

Privacy is the desire to control the use of what?

A

personsal data

45
Q

Establishing and publishing the requirements associated with PII allows an organization to ensure what?

A

that the awareness of privacy requirements is spread throughout the organization and incorporated into plans, policies, and procedures

46
Q

With regard to PII storage, organizations must clearly designate what?

A
  • elements of PII that are being collected
  • elements of PII that are stored
  • security provisions
  • storage time
47
Q

With regard to PII usage, organizations must clearly state what?

A

what the PII will be used for, including any transfer to third parties

48
Q

With regard to security policies, due care addresses what?

A

whether the organization has a minimal set of policies that provides reasonable assurance of success in maintaining security

(involves taking action)

49
Q

With regard to security, due diligence requires what?

A

that management do something to ensure security, such as implement procedures for testing and review of audit records, internal security controls, and personnel behavior

50
Q

Incident response is a team-led activity that does what?

A

prevents, detects, and responds to security breaches

51
Q

What do forensic tasks involve?

A

the collection and perseverance of digital evidence

52
Q

Continuous monitoring involves what?

A

tracking changes to the information system that occur during its lifetime and then determining the impact of those changes on the system security controls

53
Q

Ongoing security is a coordinate effort that can do what?

A

move protection priorities in response to the shifting threat landscape and requirements

54
Q

User training and awareness have what benefits for the company?

A

they ensure employees understand what security expectations are placed on them so they can better protect organizational assets and business objectives

55
Q

Auditing requirements and frequency function as what?

A

a set of checks and balances to measure that he desired level of security control is actually present and functioning as designed

CASP+ (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions