IT Security Framework

Question 1

What do we use IT Security Frameworks for?

Answer 1

As a basis for out policies, procedures, and standards.

Question 2

Who makes the consensus-developed secure configuration guidelines for hardening, prescriptive, prioritized, and “simplified” cybersecurity best practices?

Answer 2

Center for Internet Security (CIS)

Question 3

What framework integrates security and risk management into the development life cycle?

Answer 3

Risk Management Framework (RMF)

Exam Tip: Made by NIST, used by federal government

Question 4

What set of industry standards and best practices is created by NIST to help manage cybersecurity risks?

Answer 4

Cybersecurity Framework (CSF)

Question 5

What international standard details requirements for establishing, implementing, and maintaining a continually improving Information Security Management System (ISMS)?

Answer 5

ISO 27001

Note: Information Systems

Note: This is a basic procedure for cyber security and is an international standard

Question 6

What international standard provides best practice recommendations for controls on Information Security Management Systems?

Answer 6

ISO 27002

Note: Controls to protect Information Systems

Question 7

What international standard acts as a privacy extension for ISO 27001?

Answer 7

ISO 27701

Note: Privacy for Information Systems

Question 8

What international standard regards risk management?

Answer 8

ISO 31000

Note: Risk Management

Question 9

What is the audit performed in conjunction with using controls such as NIST?

Answer 9

System and Organization Controls (SOC)

Question 10

What standard is based on the following Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy?

Answer 10

SOC 2

Note: Expect to see SOC 2 on exam.

Question 11

What audit addresses the operational effectiveness of the security controls implemented over a specified amount of time.

Answer 11

SOC 2 Type II

Note: It’s just checking how effective your implementation of the security controls are.

Question 12

What security framework addresses cloud security for vendors and customers?

Answer 12

Cloud Security Alliance’s Cloud Control Matrix

Question 13

What methodology and set of tools do we use as a reference for cloud security?

Answer 13

Cloud Security Alliance’s Reference Architecture