Chapter 1 Review

Question 1

Chapter 1 - Review

Information security governance is the top-down management and control of these 2 concerns in an organization.

Answer 1

SECURITY and RISK MANAGEMENT

Question 2

Chapter 1 - Review

Governance is usually undertaken through this group of people that consists of individuals from this level throughout the organization.

Answer 2

SECURITY STEERING COMMITTEE
EXECUTIVES

Question 3

Chapter 1 - Review

The steering committee is responsible for the overall setting of these 2 things, ensuring that security strategy aligns with the organization’s IT and business strategy and objectives

Answer 3

STRATEGIC DIRECTION and POLICY

Question 4

Chapter 1 - Review

The directives of the steering committee are carried out through these 2 activities that steer the security organization toward strategic objectives.

Answer 4

PROJECTS and TASKS

Question 5

Chapter 1 - Review

The steering committee can monitor progress through these 2 methods

Answer 5

METRICS and a BALANCED SCORECARD

Question 6

Chapter 1 - Review

For an information security program to be successful, it must align with the business and its overall (i)____ , (ii) ____ and ____ , and (iii) ____

Answer 6

MISSION
GOALS and OBJECTIVES
STRATEGY

Question 7

Chapter 1 - Review

The security program must consider the organization’s notion of these 5 things;

1. ____ ; representative worth of something of importance to the organisation
2. ____ ; attitudes of the business
3. ____ ; Senior management taste for danger
4. ____ ; Required by law
5. ____ ; The environment within which the organisation is operating

Answer 7

1. ASSET VALUE
2. CULTURE
3. RISK TOLLERANCE / RISK APPETITE
4. LEGAL OBLIGATIONS
5. MARKET CONDITIONS

Question 8

Chapter 1 - Review

A successful and aligned security program does not lead the organization but does these 2 things to help it carry out its mission and pursue its goals.

Answer 8

ENABLES and SUPPORTS

Question 9

Chapter 1 - Review

Security governance is accomplished using the same means as IT governance: it begins with this org level involvement that sets the tone for risk appetite

Answer 9

BOARD LEVEL

Question 10

Chapter 1 - Review

Security Governance is carried out through this person/role, who develops security and privacy policies and a strategic security program

Answer 10

CHIEF INFORMATION SECURITY OFFICER
(CISO)

Question 11

Chapter 1 - Review

The strategic security program includes these 8 areas;

1. S____ Assurance
2. C____ Management
3. V____ Management
4. C____ Management
5. I____ Management
6. V____ Management
7. S____ A ____ Training
8. I____ & A ____ Management

Answer 11

1. SOFTWARE ASSURANCE
2. CHANGE MANAGEMENT
3. VENDOR MANAGEMENT
4. CONFIGURATION MANAGEMENT
5. INCIDENT MANAGEMENT
6. VULNERABILITY MANAGEMENT
7. SECURITY AWARENESS TRAINING
8. IDENTIDY AND ACCESS MANAGEMENT

Question 12

Chapter 1 - Review

1. SOFTWARE ASSURANCE
2. CHANGE MANAGEMENT
3. VENDOR MANAGEMENT
4. CONFIGURATION MANAGEMENT
5. INCIDENT MANAGEMENT
6. VULNERABILITY MANAGEMENT
7. SECURITY AWARENESS TRAINING
8. IDENTIDY AND ACCESS MANAGEMENT

The above are all areas included within this program

Answer 12

STRATEGIC SECURTIY PROGRAM

Question 13

Chapter 1 - Review

Security governance is used to establish these 2 things in relation to personnel for security-related activities throughout all layers of the organization

Answer 13

ROLES and RESPONSIBILITIES

Question 14

Chapter 1 - Review

Roles and responsibilities are defined in these 3 places;

1. J____ descriptions
2. P____ & P ____ documents
3. R____ charts

Answer 14

1. JOB DESCRIPTIONS
2. POLICY and PROCESS DOCUMENTS
3. RACI CHARTS

Question 15

Chapter 1 - Review

The board of directors is responsible for overseeing these in an organization.

Answer 15

ALL ACTIVITIES

Question 16

Chapter 1 - Review

Boards of directors select and manage a chief executive officer responsible for developing this function to manage;

1. Assets
2. Budgets
3. Personnel
4. Processes
5. Risk

Answer 16

GOVERNANCE FUNCTION

Question 17

Boards of directors select and manage a chief executive officer responsible for developing a governance function to manage these 5 things;

1. ____ ; Information, information systems things of value to the business
2. ____ ; Money for the program
3. ____ ; People working within the program
4. ____ ; Methodologies
5. ____ ; Concerns related to threats, liklihood, and impact

Answer 17

1. ASSETS
2. BUDGETS
3. PERSONNEL
4. PROCESSES
5. RISK

Question 18

Chapter 1 - Review

The security steering committee is responsible for this overall in terms of a means to obtain objectives

Answer 18

STRATEGIC PLANNING

Question 19

Chapter 1 - Review

The security steering committee will develop and approve security policies and appoint managers to develop and maintain these 3 things in the execution of those policies

Answer 19

PROCESSES, PROCEDURES and STANDARDS

Question 20

Chapter 1 - Review

Processes, procedures and standards should align with one another and with the organization’s overall (i) ____ , (ii) ____ , (iii) ____ and ____

Answer 20

MISSION, STRATEGY, GOALS, and OBJECTIVES

Question 21

Chapter 1 - Review

The CISO will develop these to be business-aligned and will support the organization’s overall mission and goals

Answer 21

SECURITY STRATEGIES

Question 22

Chapter 1 - Review

The CISO is responsible for this in the organization’s overall

Answer 22

SECURITY PROGRAM

including policy development, risk management, and perhaps some operational activities such as vulnerability management, incident management, access management, and security awareness training.

Question 23

Chapter 1 - Review

This person is responsible for the protection and proper use of sensitive personal information

Answer 23

CHIEF PRIVACY OFFICER
(CPO)

AKA DPO

Question 24

Chapter 1 - Review

The CPO’s information protection responsibilities are sometimes shared with this person, who has overall information protection responsibilities.

Answer 24

CHEIF INFORMATION SECURITY OFFICER

Question 25

Chapter 1 - Review

The chief compliance officer is responsible these 2 activities

Answer 25

COMPLIANCE TRACKING and REPORTING

Question 26

Chapter 1 - Review

All roles in IT have ____

Answer 26

SECURITY RESPONSIBILITIES

Question 27

Chapter 1 - Review

Large organisations will suffer the issue where this will change more slowly than the environment.

Answer 27

STANDARDS