I. Control Frameworks

Question 1

Approach recommended by ISO/IEC 27001 to select a control framework

Answer 1

Start with a well-known control framework and then create additional control if needed, to address risks specifics to the organization.

Question 2

COBIT

Answer 2

Control Objectives for Information and Related Technologies.

Is an IT management framework developed by the IT Governance Institute and ISACA.

Question 3

Four domain of COBIT

Answer 3

Plan and Organize,
Acquire and Implement,
Deliver and Support,
Monitor and Evaluate

Question 4

What is COBIT

Answer 4

an IT process framework that includes security processes that are interspersed throughout the framework.

Question 5

ISO/IEC 27001

Answer 5

is an international standard for information security and risk management.

It has two sections: Requirements and Controls

Question 6

ISO/IEC 38500

Answer 6

an international standard on the corporate governance of information technology, suitable for small and large organizations in the public or private sector.

Question 7

ITIL / ISO/IEC 20000

Answer 7

Known as the IT Infrastructure Library, ITIL is a framework of processes for IT service delivery and IT service management.

Question 8

HIPAA

Answer 8

The U.S. Health Insurance Portability and Accountability Act established requirements for the protection of electronic protected health information (EPHI).

Question 9

HIPAA requirements

Answer 9

• Administrative safeguards
• Physical safeguards
• Technical safeguards

Question 10

NIST SP 800-53

Answer 10

Required for all U.S. government information systems as well as all private company that store or process information on behalf of the U.S. federal government.

Question 11

NIST Cybersecurity Framework or NIST CSF

Answer 11

It is a risk-based life-cycle methodology for assessing risk, enacting controls, and measuring control effectiveness that is not unlike ISO/IEC 27001.

Question 12

Components of NIST CSF

Answer 12

Framework Core - Includes functions such as Identify, Protect, Detect. Respond, Recover.

Framework Implementation Tiers

Framework Profile

Question 13

The Critical Security Controls (CSC) framework

Answer 13

a well-known control framework that traces its lineage back to the SANS organization. The framework is still commonly referred to as the “SANS 20” or “SANS 20 Critical Security Controls.”

Question 14

The Payment Card Industry Data Security Standard or PCI-DSS

Answer 14

a control framework specifically for the protection of credit card numbers and related information when stored, processed, and transmitted on an organization’s networks.