Governance and compliance

Question 1

Governance

Answer 1

IT security governance determines who is authorised to make decisions about cybersecurity risks within an organisation. It demonstrates accountability and provides oversight to ensure that any risks are adequately mitigated and that security strategies are aligned with the organisation’s business objectives and are compliant with regulations.

Question 2

IT security management

Answer 2

IT security management defines and implements the controls that an organisation needs to have in place to mitigate risks.

Question 3

Data Governance

Answer 3

Data governance determines who is authorised to make decisions about data within an organisation.

Question 4

Data owner

Answer 4

A person who ensures compliance with policies and procedures, assigns the proper classification to information assets and determines the criteria for accessing information assets.

Question 5

Data controller

Answer 5

A person who determines the purpose for which, and the way in which, personal data is processed.

Question 6

Data processor

Answer 6

A person or organisation who processes personal data on behalf of the data controller.

Question 7

Data custodian

Answer 7

A person who implements the classification and security controls for the data in accordance with the rules set out by the data owner.

Question 8

Data steward

Answer 8

A person who ensures that data supports an organisation’s business needs and meets regulatory requirements.

Question 9

Data protection officer

Answer 9

A person who oversees an organisation’s data protection strategy.

Question 10

Cybersecurity Policy

Answer 10

A high-level document that outlines an organisation’s vision for cybersecurity, including its goals, needs, scope and responsibilities.
Specifically, it:
- Demonstrates an organisation’s commitment to security.
- Sets the standards of behaviour and security requirements for carrying out activities, processes and operations, and protecting technology and information assets within an organisation.
- Ensure that the acquisition use and maintenance of system operations, software and hardware is consistent across the organisation.
- Defines the legal consequences of policy violations.
- Gives the security team the support they need from senior management.

Question 11

Master cybersecurity policy

Answer 11

The blueprint for an organisation’s cybersecurity program, their policy serves as the strategic plan for implementing cybersecurity controls.

Question 12

System-specific policy

Answer 12

This type of policy is developed for specific devices or computer systems and aims to establish standardisation for approved applications, software, operating system configurations, hardware and hardening countermeasures within an organisation.

Question 13

Identification and authentication policy

Answer 13

Specifies who should be permitted access to network resources and what verification procedures are in place to facilitate this.

Question 14

Password policy

Answer 14

Defines minimum password requirements, such as the number and type of characters used and how often they need to be changed

Question 15

Acceptable use policy

Answer 15

Highlights a set of rules that determine access to and use of network resources. It may also define the consequences of policy violations.

Question 16

Acceptable use policy

Answer 16

Highlights a set of rules that determine access to and use of network resources. It may also define the consequences of policy violations.

Question 17

Remote access policy

Answer 17

Sets out how to remotely connect to an organisation’s internal network and explains what information is remotely accessible.

Question 18

Network maintenance policy

Answer 18

Outlines procedures for updating an organisation’s specified operating systems and end-user applications.

Question 19

Incident handling police

Answer 19

Provides guidance on how to report and respond to security-related incidents within an organisation.

Question 20

Data policy

Answer 20

Sets out measurable rules for processing data within an organisation, such as specifying where data is stored, how data is classified and how data is handles and disposed of.

Question 21

Credential policy

Answer 21

Enforces the rules for composing credentials, such as the minimum and maximum length of a password