Section 11.98 Policies

Question 1

Policies

Acceptable Use Policy (AUP)

Answer 1

Document that outlines the do’s and don’ts for users when interacting with an organisation’s IT systems and resources

■ Defines appropriate and prohibited use of IT systems/resources

■ Aims to protect organizations from legal issues and security threats

Question 2

Policies

Information Security Policies

Answer 2

Outlines how an organisation protects its information assets from threats, both internal and external

These policies cover a range of areas:
● Data Classification
● Access Control
● Encryption
● Physical Security

Ensures confidentiality, integrity, and availability of data

Question 3

Policies

Business Continuity Policy

Answer 3

Ensures operations continue during and after disruptions

■ Focuses on critical operation continuation and quick recovery

■ Includes strategies for power outages, hardware failures, and disasters

Question 4

Policies

Disaster Recovery Policy

Answer 4

Focuses on IT systems and data recovery after disasters

■ Outlines data backup, restoration, hardware/software recovery, and alternative locations

Question 5

Policies

Incident Response Policy

Answer 5

Addresses detection, reporting, assessment, response, and learning from security incidents

■ Specifies incident notification, containment, investigation, and prevention steps

■ Minimises damage and downtime during incidents

Question 6

Software Development Lifecycle (SDLC) Policy

Answer 6

Guides software development stages from requirements to maintenance

■ Includes secure coding practices, code reviews, and testing standards

■ Ensures high-quality, secure software meeting user needs

Question 7

Change Management Policy

Answer 7

Governs handling of IT system/process changes

■ Ensures controlled, coordinated change implementation to minimize disruptions

■ Covers change request, approval, implementation, and review processes