Information Security Governance Flashcards

Question

The FIRST action for an information security manager to take when presented with news that new regulations are being applied to how enterprises handle sensitive data is to determine: A.processes and activities that may be affected. B.how senior management would prefer to respond. C.whether the enterprise qualifies for an exemption. D.the approximate cost of compliance.

Answer 1

A is the correct answer. Justification Changes to information security are best made on the basis of risk. To determine the risk associated with the new regulations, the information security manager must first know what processes and activities may be affected. Senior management will not have a basis for preference until potential effects are determined and compliance requirements are identified. Requesting exemptions comes at a cost, at least in terms of time and potentially with reputational consequences. Also, if there is little or no effect on the enterprise, there will be no need to request an exemption even if one is available. Until the scope of potential effects and the changes that may be needed to comply are understood, the cost of compliance cannot be reasonably approximated.

Answer 2

B is the correct answer. Justification Consulting the steering committee before knowing the extent of the issues would not be the first step. Because they are regulatory requirements, a gap analysis would be the first step to determine the level of compliance already in place. Implementing compensating controls would not be the first step. Demanding immediate compliance without knowing the extent of possible noncompliance would not be a prudent first step.

Answer 3

D is the correct answer. Justification Periodic audits can be effective but only when combined with reporting. Vulnerability scanning has little to do with noncompliance with standards. Training can increase management’s awareness regarding information security, but awareness training is generally not as compelling to management as having individual names highlighted on a compliance report. Reporting noncompliance to the audit committee is the most effective way to have enforcement for concerned parties to take the proper action in order to comply.

Answer 4

C is the correct answer. Justification Corporate legal officers are often focused on contractual matters and disclosure requirements for reporting to the agencies regulating publicly held corporations. Internal auditors would typically be concerned with review of existing compliance requirements rather than with new legal or regulatory requirements. The departments affected by legal and regulatory requirements (such as the human resources department) are typically advised by their respective associations of new or changing regulations and the probable impacts on various enterprises. Compliance officers are typically charged with determining compliance with internal policies and standards.

Answer 5

B is the correct answer. Justification Business strategy and direction would address the issue of business record retention among numerous others but would typically not be the primary focus. Retention of business records is primarily driven by legal and regulatory requirements. Storage capacity and longevity are important but secondary issues. Business case and value analysis would be secondary to complying with legal and regulatory requirements.

Answer 6

A is the correct answer. Justification Monitoring processes are required to guarantee compliance with laws and enterprise regulations; therefore, the information security manager will be obligated to advise compliance with the law. Even if short-term impact cannot be determined, it is a business decision to accept the risk. Industry security practices do not override the business decision to accept the risk. Changes in the roles matrix do not override the business decision to accept the risk.

Answer 7

C is the correct answer. Justification The chief security officer is not responsible for the legal and regulatory liability of the enterprise arising from failures of security. The chief legal counsel is not individually responsible for the legal and regulatory liability for failures of security in the enterprise. The board of directors and senior management are ultimately responsible for ensuring regulations are appropriately addressed and will be responsible for the legal and regulatory liability for failures of security in the enterprise. The information security steering group is not responsible for the legal and regulatory liability arising from failures of security in the enterprise.

Answer 8

B is the correct answer. Justification The extent of enforcement is a measure of probability. Without knowing the scope of consequences, probability cannot be viewed in context. Legal and regulatory requirements should be treated as any other risk to the enterprise, calculated as the probability of enforcement and the magnitude of possible sanctions (impact or consequences). Sanctions or impact must be considered in the context of the enforcement mechanisms. If sanctions have less probability of being implemented due to lax enforcement, their severity poses lower risk to the enterprise than if they are widely enforced. Except in extreme cases of fraud or other criminal activity, liability for regulatory sanctions generally lies with senior management and the board of directors. It is not a driving factor in the evaluation of regulatory requirements.

Answer 9

B is the correct answer. Justification Information security can advise management on the risk and possible impact of compliance failure, but the business decision must be made by senior management. The extent of compliance with legal and regulatory requirements is a business decision that must be made by senior management. Legal and regulatory requirements are no different from other requirements for purposes of risk assessment and decision-making. Each legal or regulatory requirement is evaluated in the context of the risk posed by failure to comply. Cost is only one aspect of the overall business decision to comply with legal and regulatory requirements.

Answer 10

A is the correct answer. Justification Most privacy laws and regulations require disclosure on how information will be used. A disclaimer may be prudent but is not necessary because it does not refer to data privacy. Technical details regarding how information is protected are not mandatory to publish on the website and would not be desirable. It is not mandatory to say where information is being hosted.

Answer 11

D is the correct answer. Justification Data mining is an accepted tool for ad hoc reporting; it could pose a threat to privacy only if it should violate regulatory provisions. Identity theft is a potential consequence of privacy violations but not the main focus of many regulations. Human rights protection addresses privacy issues but is not the main focus of regulations. Protection of identifiable personal data is the major focus of privacy regulations such as the Health Insurance Portability and Accountability Act (HIPAA).

Answer 12

B is the correct answer. Justification Directing regulators to a specific person or department is not a method for being prepared for a regulatory review as this will only serve as an action for facilitation of the review. Self-assessments provide the best feedback on level of compliance or readiness and permit identification of items requiring remediation. Assessing previous regulatory reports is not as effective as performing self-assessments because conditions may have changed. The legal department should review all formal inquiries, but that would not help prepare for a regulatory review.

Answer 13

D is the correct answer. Justification The exception process can be used after assessing the noncompliance risk and determining whether compensating controls are required. Modifying policy is not necessary unless there is no applicable standard and policy. It is not appropriate to increase compliance enforcement until the information security manager has determined the extent of the risk posed by weak compliance. The first action after finding noncompliance with particular standards should be to determine the risk to the enterprise and the potential impact (for both compliance and security risk).

Answer 14

B is the correct answer. Justification The corporate data privacy policy cannot direct that the information security policy be in compliance with it, as it addresses a different function and may be a subset itself. As a subsidiary, the local entity will have to ensure that the information security program complies with local law of the land for data protection, privacy and security. Senior management may be held accountable in event of noncompliance. Data privacy policy directives of the headquarters country may not be applicable, since the enterprise policies should be in compliance with requirements of the local law that applies and not the law applicable to the head office under which the privacy policy would have been made. Data privacy laws are country-specific. With local regulations differing from the country in which the enterprise is headquartered, it is improbable that a group-wide policy would address all the local legal requirements. Data privacy laws are country-specific.

Answer 15

C is the correct answer. Justification Good practices are rarely the most effective answer for a particular enterprise. They may be a useful guide but typically are not a primary concern. Business requirements are a concern for formulating data retention policies and will have to be compliant with the requirements of the law of the land. The primary concern for development of the data retention policy is alignment with the local legislative and regulatory requirements. Compliance is a business need, and internal policies or procedures cannot take precedence over the law of the land. Storage is an irrelevant consideration when developing the data retention policy, as necessary provisions must be made as needed.

Answer 16

A is the correct answer. Justification Privacy policies must contain notification requirements in the event of unauthorized disclosure and opt-out provisions. Privacy policies do not address warranties, which are generally unrelated to a privacy policy. Privacy policies may address liabilities as a consequence of unauthorized disclosure, but that is not the most important component. Standards regarding privacy would be separate and not a part of the policy.

Answer 17

C is the correct answer. Justification Authentication of the point-of-sale terminal will not prevent unauthorized reading of the data. Hardening will protect the point-of-sale but will not prevent unauthorized reading of the data. Cardholder data should be encrypted using strong encryption techniques. Non-repudiation is not relevant to credit card data protection.

Answer 18

B is the correct answer. Justification Current and future technologies would be considered but will not generally be affected by operational regions or countries. Information security laws vary from country to country. An enterprise must be aware of and comply with the applicable laws from each country, as noncompliance may have a great impact on local operations. Economizing the costs of network bandwidth is a part of business costs; however, this is not a relevant consideration for information security. Centralization of information security is a business decision and is not a significant factor in multinational operations to impact security operations.

Answer 19

C is the correct answer. Justification Senior management, not the security administrator, holds ultimate responsibility for the effectiveness of security controls. Although the authority to implement is delegated, responsibility cannot be delegated. The chief information security officer may have been delegated the authority to verify the effectiveness of security controls, but final responsibility still rests with senior management. Senior management holds ultimate responsibility for the effectiveness of security controls. The information systems auditor may be assigned testing of the effectiveness of security controls but is not responsible for their effectiveness.

Answer 20

A is the correct answer. Justification The primary purpose of the information security program is to provide protection to information assets and it must be aligned with the business’s strategy and objectives. The risk assessment program is focused on identifying risk scenarios based on the business’s strategy and objectives. It is a part of the information security program and one of its key activities but not it’s primary purpose. The information security program needs to address confidentiality, integrity and availability. Confidentiality alone cannot be considered the primary purpose of the information security program. Security policy and procedures are developed as part of the security program to achieve protection for information assets consistent with business strategy and objectives.

Answer 21

B is the correct answer. Justification Governance, risk and compliance (GRC) is generally not used in support of operations and marketing. GRC is largely concerned with ensuring that processes in IT, finance and legal are in compliance with regulatory requirements; that proper rules are in place; and that risk is appropriately addressed. Audit, risk and regulations are functions to support IT, finance and legal. Information security and risk can be a part of GRC and interrelate to audit, risk and regulations, but are primarily in support of IT, finance and legal.

Answer 22

A is the correct answer. Justification Defining and ratifying the data classification structure and handling procedures, consistent with the enterprise’s risk appetite and the business value of information assets, is the primary role of the information security manager in relation to the data classification and handling process within the enterprise. The responsibility for assigning the classification levels to information assets rests with the data owners and not the information security manager. The job of securing information assets is the responsibility of the data custodians and not the information security manager. Confirming proper classification of information assets may be a role of the information security auditor performing compliance reviews.

Answer 23

C is the correct answer. Justification Security administrators are responsible for implementing, monitoring and enforcing security rules established and authorized by management, but they are not ultimately accountable for the protection of sensitive data. The IT steering committee assists in the delivery of the IT strategy, oversees management of IT service delivery and IT projects, and focuses on implementation aspects, but it is not ultimately accountable for the protection of sensitive data. The board of directors is ultimately accountable for information security, just as it is for all organizational assets. The information security manager is responsible for identifying and explaining to stakeholders the risk to the enterprise’s information, presenting alternatives for mitigation, and then implementing an approach supported by the enterprise.

Answer 24

C is the correct answer. Justification Interviewing specialists should be performed by the information security manager. Development of program content should be performed by the information security staff. Prioritizing information security initiatives falls within the scope of an information security steering committee. Approving access to critical financial systems is the responsibility of individual system data owners.

Answer 25

B is the correct answer. Justification Standards may provide metrics for deployment but would not provide significant management tools. Deploying complex security initiatives and integrating a range of diverse projects and activities would be more easily managed with the overview and relationships provided by a security architecture. Policies would guide direction but would not provide significant management tools. Management support is always helpful and may assist in providing resources, but it would be of little direct benefit in managing complex security deployments.

Answer 26

D is the correct answer. Justification Making emergency changes to data is an infrastructure task performed by custodians of the data. Administering database security is an infrastructure task performed by custodians of the data. Migrating code to production is an infrastructure task performed by custodians of the data. Data owners approve access to data and determine the degree of protection that should be applied (data classification).

Answer 27

B is the correct answer. Justification Sponsoring the creation of the steering committee should be initiated by someone versed in the strategy and direction of the business. A security manager would be looking to this group for direction and is therefore not in the best position to oversee the formation of this group. The chief operating officer (COO) represents senior management, which is responsible for providing support for information security initiatives with a positive tone at the top. The information security steering group should be sponsored by the COO (senior management), as that individual would have the authority (and responsibility) to direct the participation of business unit heads and authorize the mandate or charter. The internal auditor may be a member of the steering group but would not have the authority to make decisions or take actions to oversee the formation of the committee. Legal counsel may be a member of a steering group but would not have the authority to make decisions or take actions to oversee the formation of the committee.

Answer 28

B is the correct answer. Justification When business logic has been modified, the application development team may be involved in testing; however, the team’s involvement will be less necessary when a security patch is being released. In order to ensure that no serious business interruption takes place due to any unexpected problems, it is important to bring IT asset owners into the final sign-off loop when a security patch is being released. The information security officer is informed of security patches currently being released; however, the information security officer’s approval may not always be required for patch release. A business continuity coordinator would not be involved in approving security patches in normal day-to-day operations.

Answer 29

C is the correct answer. Justification Protecting IT assets is one goal among many others included in the stated objectives. However, it should be viewed from the perspective of achieving an enterprise’s objectives. Preventive controls are not always possible or necessary; risk management will address issues with an appropriate mix of preventive and corrective controls to achieve the stated objectives. Risk management’s primary goal is to ensure an enterprise maintains the ability to achieve its objectives. Ensuring infrastructure and systems availability is one typical goal included in the stated objectives.

Answer 30

A is the correct answer. Justification Verifying the decision with the business units is the correct answer because it is not the IT function’s responsibility to decide whether a new application modifies business processes. Checking the system’s risk analysis does not consider the change in the applications. Recommending the update after post-implementation review delays the update. Requesting an audit review delays the update.

Answer 31

A is the correct answer. Justification Because the information owner best understands the nature of the information in the system and who needs access to the information, the information owner should provide authorization for users to access the information systems under their control. The security manager will be responsible for ensuring that access controls are functioning properly and for assessing the risk of unauthorized access but is not responsible for granting access rights. The chief information officer will only have responsibility for authorizing access to information related to systems and networks within the CIO's domain. System administrators are primarily custodians and should only have access to their required operational systems information.

Answer 32

B is the correct answer. Justification Rotation of steering committee leadership does not help in achieving strategic alignment of information security initiatives. It is important to achieve consensus on risk and controls and obtain inputs from various organizational entities because security must be aligned with the needs of all business units in the enterprise. Updating business strategy does not lead to achieving strategic alignment of information security initiatives. Procedures and standards do not need to be approved by all departmental heads and this activity would not lead to achieving strategic alignment of information security initiatives.

Answer 33

C is the correct answer. Justification Contracts can define responsibilities, but it is essential that individuals are accountable. Penalties can reinforce accountability and are a deterrent control but will not ensure that responsibilities are always discharged properly. Assigning accountability to individuals is most likely to ensure that duties are properly carried out. Policies generally record a high-level principle or course of action that has been decided on; they are advantageous, but it is more effective to establish direct accountability to ensure that responsibilities are performed.

Answer 34

A is the correct answer. Justification An information security manager is primarily responsible and accountable for managing the information security risk management plan by involving various asset and risk owners to identify and implement appropriate responses. An information security manager may help in standardizing the baseline configuration for IT assets, but implementing the configuration is the responsibility of the asset owners. The information security manager may facilitate a business impact analysis (BIA) conducted by business process owners. The information security manager monitors closure of vulnerabilities by asset owners.

Answer 35

C is the correct answer. Justification The security steering committee will guide and ensure that a security policy is aligned with business objectives but is not responsible for enforcement. The chief information officer may to some extent be involved in the enforcement of the policy but is not directly responsible for it. Information security policy enforcement is the responsibility of the chief information security officer. The chief compliance officer is usually involved in determining the level of compliance but is usually not directly involved in the enforcement of the policy.

Answer 36

C is the correct answer. Justification Without a clear definition of the needs to be addressed, the objectives cannot be determined. Costs cannot be determined without a definition of the needs to be addressed. The first step is to have a clear definition of the needs to be fulfilled when developing a business case for an information security investment. Without a defined need requiring a solution, cost-effectiveness cannot be determined.

Answer 37

A is the correct answer. Justification A brief explanation of the benefit of expenditures in the budget helps to convey the context of how the purchases that are being requested will meet business goals and objectives. This helps build credibility for the information security function or program. Explanations of benefits will make it easy for senior management to understand the requirements and support the information security program. While the budget should consider all inputs and recommendations that are received from the business, the budget that is ultimately submitted to management for approval should include only those elements that are intended for purchase. Total cost of ownership may be requested by management and may be provided in an addendum to a given purchase request, but it is not usually included in an annual budget. Baseline comparisons (cost comparisons with other companies or industries) may be useful in developing a budget or providing justification in an internal review for an individual purchase but usually do not need to be included in the request for budget approval.

Answer 38

D is the correct answer. Justification Efficiency is not the primary desired outcome of the integration of governance throughout enterprise business functions. Standardization will help create a more efficient program, but it is not the primary objective for integration of information security governance into all business functions. While good governance may help promote strategic alignment, it is not the primary reason to ensure integration of governance in all organizational functions. The primary objective for integration of information security governance into all business functions and activities is to address operational risk. All aspects of organizational activities pose risk that is mitigated through effective information security governance and the development and implementation of policies, standards and procedures.

Answer 39

D is the correct answer. Justification The sales department cannot be the owner of the asset because that removes personal responsibility. The database administrator is a custodian. The chief information officer (CIO) is not an owner of this database because the CIO is less likely to be knowledgeable about the specific needs of sales operations and security concerns. The owner of the information asset should be the individual with the decision-making power in the department deriving the most benefit from the asset. In this case, it is the head of the sales department.

Answer 40

D is the correct answer. Justification The custodian enforces protection of assets, depending on their classification. The security manager develops the structure and standards for classification and may classify the information under the role's ownership. Senior management generally does not determine classification levels unless it is also the information owner. Classifying an information asset is the responsibility of the asset owner.

Answer 41

D is the correct answer. Justification Management is responsible for higher-level issues such as providing and approving budget, supporting activities, etc. The information custodian is responsible for day-to-day security tasks such as protecting information, backing up information, etc. Users are the lowest level. They use the data but do not classify the data. The owner classifies the data. Although the information owner may be in a management position and is also considered a user, the information owner role has the responsibility for determining information classification levels.

Answer 42

C is the correct answer. Justification Business unit managers should have input into IT security policies, but they should not have authority to give final approval. The chief information security officer would more than likely be the primary author of the policies and, therefore, would not be the appropriate individual to approve the policies. Senior management should have final approval of all enterprise policies, including IT security policies. The chief information officer should provide input into IT security policies but should not have the authority to give final approval.

Answer 43

D is the correct answer. Justification The data custodian is responsible for handling and operational management of information in alignment with the data classification. The database administrator is responsible not for data classification but for the technical administration of the database and for handling requirements that apply to data in storage and transit in accordance with the requirements for each classification level. The information security officer has oversight of the overall data classification and handling process to ensure conformance with enterprise policies and standards. The data owner has responsibility for data classification and to ensure consistency with the enterprise’s classification criteria.

Answer 44

B is the correct answer. Justification The system analyst would not be closely involved in testing code changes. System users, specifically the user acceptance testers, would be in the best position to note whether new exposures were introduced during the change management process. The operations manager would not be involved in testing code changes. The data security officer would not be involved in testing code changes.

Answer 45

B is the correct answer. Justification The chief security officer may know what is needed but will not have the authority to sponsor initiatives. A sponsor should have far-reaching influence across the enterprise. The chief operating officer has the authority and will be responsible to sponsor the design and implementation of new security infrastructure. This is in line with the commitment of top management to support information security. The chief privacy officer may not have the knowledge of the day-to-day business operations and overall security requirements to ensure proper guidance; nor will this position have the authority to sponsor the initiative. The chief legal counsel will typically have a narrow legal focus on contracts and stock and other regulatory requirements and have little knowledge of overall organizational security requirements; nor will this position have the authority to sponsor the initiative.

Answer 46

A is the correct answer. Justification Individual business managers are in the best position to determine the value of information assets since they are most knowledgeable of the assets’ impact on the business. Business systems analysts are not as knowledgeable as individual business managers regarding the impact on the business. Information security managers are not as knowledgeable as individual business managers regarding the impact on the business. Peer companies’ industry averages do not necessarily provide information that is detailed enough, nor are they as relevant to the unique aspects of the business as information from individual business managers.

Answer 47

D is the correct answer. Justification Complexity of technology would be factored into the security governance model of the enterprise, so, it would not have a major effect on implementation. Budgetary constraints would inhibit effective implementation of security governance but likely would be a consequence of the lack of high-level sponsorship and, therefore, a secondary situation. Conflicting business priorities must be addressed by senior management in order to facilitate implementation of effective security governance, which would more likely be accomplished with high-level sponsorship. The need for senior management involvement and support is a key success factor for the implementation of effective security governance.

Answer 48

C is the correct answer. Justification Evaluation of third parties requesting connectivity is an acceptable practice and does not present any conflict of interest. Assessment of disaster recovery plans is an acceptable practice and does not present any conflict of interest. Because senior management is ultimately responsible for information security, it should approve information security policy statements; the information security manager should not have final approval as it would represent a conflict of interest. Monitoring of adherence to physical security controls is an acceptable practice and does not present any conflicts of interest.

Answer 49

D is the correct answer. Justification The information security manager usually has some responsibility for monitoring and assessing security compliance, but enforcement is typically the responsibility of the unit management or human resources. Executive management normally monitors compliance. Compliance officers are usually concerned with legal and regulatory compliance issues such as privacy. Compliance responsibilities are usually shared across organizational units and the results shared with executive management and the board of directors’ audit or compliance committee.

Answer 50

B is the correct answer. Justification The information security officer supports and implements information security for senior management. Routine administration of all aspects of security is delegated, but the security steering committee must retain overall responsibility. The data owner is responsible for categorizing data security requirements. The data custodian supports and implements information security as directed.

Answer 51

A is the correct answer. Justification Close integration of information security governance with overall enterprise governance is likely to provide better long-term security by institutionalizing its activities and increasing visibility in all enterprise activities. Increased budgets and staff may improve security, but they will not have the same beneficial impact as incorporating security into the strategic levels of the enterprise’s operations. Control strength and compliance efforts must be balanced against business requirements, culture and other enterprise factors that are best accomplished at governance levels. While technical security controls may improve some aspects of security, they will not address management issues nor provide enduring changes that are needed for an overall improvement of the enterprise security posture.

Answer 52

D is the correct answer. Justification Defining roles and responsibilities does not by itself improve policy compliance without proper monitoring and enforcement of accountability. Procedure flows are not necessarily affected by defining roles and responsibilities. Segregation of duties is more likely to occur as a result of policy compliance enforcement than simply defining roles and responsibilities, although that is a necessary first step. Defining roles and responsibilities makes it clear who is accountable for performance and outcomes.

Answer 53

C is the correct answer. Justification The frequency of information security breaches may assist in justifying the budget but is not of much use because it only illustrates the volume of incidents and does not provide information about the benefits from the expenditure. Annual loss expectancy does not address the potential benefit of information security investment. Cost-benefit analysis is the best way to justify the information security budget. Peer group comparison would provide support for the necessary information security budget, but it would not take into account the specific needs and activities of the enterprise.

Answer 54

C is the correct answer. Justification Senior management is ultimately responsible for the enterprise. The security manager is responsible for applying security protection relative to the level of classification specified by the owner. The data owner is responsible for applying the proper classification to the data. The technology group is delegated the custody of the data by the data owner, but the group does not classify the information.

Answer 55

D is the correct answer. Justification Difficulty in filling vacancies is not uncommon due to the shortage of qualified information security professionals. It is important to have senior management, such as the chief operating officer, approve security policies to ensure they meet management intent and direction. It is not inappropriate for an oversight or steering committee to meet quarterly. A steering committee should be in place to approve all security projects. The fact that the data center manager has final sign-off for all security projects indicates that a steering committee is not being used and that information security is relegated to a subordinate place in the enterprise. This would indicate a failure of information security governance and would need to be corrected first.

Answer 56

D is the correct answer. Justification The board does not direct security operations, which are delegated to executive management. The board would not research solutions but might direct executive management to do so. Taking no action would not be a responsible course of action. The board would typically direct executive management to assess the risk and report results to enable informed decision-making.

Answer 57

B is the correct answer. Justification An assessment of risk to assets by itself does not indicate senior management commitment and support for information security. Management sign-off on risk management methodology is the best indicator of support and commitment to information security, as it demonstrates management involvement in control design. A review of inherent risk to information assets is not an indication of senior management commitment and support for information security. Reviewing residual risk may be a step in gaining commitment and support for information security but by itself is not sufficient.

Answer 58

D is the correct answer. Justification Functional requirements and user training programs are parts of project development and are not the main risk. Specifics of training programs are usually not under the purview of the steering committee; training is an operational/delivery issue to be managed by the team or person responsible for the program. The information security steering committee does not have the mandate to approve budgets for business units. The steering committee is responsible for the execution of the information security strategy; lacking representation of user management, the committee may miss consideration of the impact on productivity and the need for adequate user controls.

Answer 59

B is the correct answer. Justification Platform security is usually the responsibility of the information security manager. Data owners are responsible for assigning user entitlements and approving access to the systems for which they are responsible. Intrusion detection is the responsibility of the information security manager. Antivirus controls are the responsibility of the information security manager.

Answer 60

C is the correct answer. Justification Uniformity in quality of service tends to vary from unit to unit. Adherence to policies is likely to vary considerably between various business units. Decentralization of information security management generally results in better alignment with business unit needs because security management is closer to the end user and can be cognizant of the local risk and threat scenario. Decentralization of information security management is generally more expensive to administer due to the lack of economies of scale.

Answer 61

D is the correct answer. Justification External audit may assess and advise on the program, and testers may be used by the program; however, they are not appropriate steering committee members. The steering committee needs to have practitioner-level executive representation. It may report to the board, but board members would not generally be part of the steering committee, except for its executive sponsor. Regulators would not participate in this committee. External trade union representatives and key security vendors are entities that may need to be consulted as part of program activities, but they would not be members of the steering committee. Leaders from IT, human resources and sales are some key individuals who must support an information security program.

Answer 62

C is the correct answer. Justification Although having the chief executive officer sign-off on the security policy makes for good visibility and demonstrates good tone at the top, it is a one-time discrete event that may be quickly forgotten by senior management. Security awareness training for employees will not have as much effect on senior management commitment as alignment with business goals. Ensuring that security activities continue to be aligned and support business goals is critical to obtaining enhanced management support. Periodic review of security activities will provide regular visibility to senior management. Although having senior management sign-off on the security strategy makes for good visibility and demonstrates good tone at the top, it is a one-time discrete event that may be quickly forgotten by senior management.

Answer 63

B is the correct answer. Justification Centralized information security management is generally less expensive to administer due to the economies of scale. Centralization of information security management results in greater uniformity and better adherence to security policies. With centralized information security management, information security is typically less responsive to specific business unit needs due to greater separation and more bureaucracy between the information security department and end users. With centralized information security management, turnaround can be slower due to greater separation and more bureaucracy between the information security department and end users.

Answer 64

A is the correct answer. Justification All personnel of the enterprise have the responsibility of ensuring information system security—including those with indirect responsibility, such as those dealing with physical security. Information systems security cannot be the sole responsibility of information systems personnel because they cannot ensure security across the entire enterprise. Information systems security cannot be the sole responsibility of information systems security personnel because they must rely on numerous other departments to ensure security and must have the buy-in and cooperation of all personnel. Information systems security cannot be the responsibility of functional personnel alone because they have limited authority and must count on other personnel to collectively ensure security.

Answer 65

A is the correct answer. Justification The existence of a steering committee that approves all security projects is the best indicator of an effective governance program. To ensure that all stakeholders impacted by security considerations are involved, many enterprises use a steering committee comprised of senior representatives of affected groups. This composition helps to achieve consensus on priorities and trade-offs and serves as an effective communication channel for ensuring the alignment of the security program with business objectives. Security policy training for all managers is important at all levels of the enterprise but it is not the best indicator of effective governance. The training program should be guided and approved as a security project by the steering committee. The availability of security training to all over the intranet, while beneficial to the overall security program, is not the best indicator of effective governance, as it is an operational activity in information security. Security training should be guided and approved as a security project by the steering committee. Even enterprises with little overall governance may be effective in patching systems in a timely manner; this is not the best indicator of effective governance. Testing and applying patches is an operational activity in information security and not part of governance.

Answer 66

D is the correct answer. Justification The legal department can advise but does not have final responsibility, as it may not be familiar with the roles and responsibilities within the department. The compliance officer can advise but does not have final responsibility, as the compliance officer may not be familiar with the roles and responsibilities within the department. The information security manager can advise but does not have final responsibility, as the information security manager may not be familiar with the roles and responsibilities within the department. Since business owners are ultimately responsible for their applications and data, they should determine data access requirements.

Answer 67

C is the correct answer. Justification The number of employees has little or no effect on standard information security governance models. The distance between physical locations has little or no effect on standard information security governance models. Information security governance modeling is highly dependent on the overall organizational structure. Some elements of organizational structure that impact information security governance are multiple missions and functions across the enterprise, leadership and lines of communication. The organizational budget may have some impact on suitable governance models depending on the one chosen because implementation of some models might not be economically viable.

Answer 68

B is the correct answer. Justification Whether senior managers collaborate is not substantially influenced by the presence or absence of a chief information security officer (CISO). Appointing a CISO creates a clear line of responsibility for information security. Due to the scope and breadth of information security, the required authority and responsibility should be assigned to a chief officer in recognition of the enterprise’s commitment. The board of directors retains its governance role regardless of whether a CISO is formally designated. The CISO is typically not associated with financial accountability for technology projects.

Answer 69

C is the correct answer. Justification Internal auditors would not be in a good position to fully understand all the business ramifications. System developers would not be aware of the impact on business operations. Business process owners are in the best position to understand how new regulatory requirements may affect their systems. Legal counsel would not be in a position to understand the ramifications.

Answer 70

C is the correct answer. Justification While it is important that information security understands the corporate rules, that is not the main reason for alignment. Regulatory compliance is not a primary driver in governance alignment. Corporate governance includes a structure and rules that in most cases are related to managing various types of risk. A lack of alignment can result in duplicate or contradictory controls, which negatively impact cost-effectiveness. Minimizing the number of rules is helpful; however, it is just one element of achieving cost-effectiveness.

Answer 71

A is the correct answer. Justification Wherever multiple departments have shared responsibility for related activities, gaps tend to emerge or there can be unneeded duplication of activities. Integrating the roles and responsibilities is the best way to mitigate these gaps, minimize duplication and ensure consistent risk management. Integrating roles and responsibilities may allow for reductions in manpower, but this is not the driving consideration of integration. Integrating roles and responsibilities may allow for more effective business continuity and disaster recovery, but this is just one of the considerations for integration. Specifications and acquisition may not be affected, depending on the particular needs of each department involved.

Answer 72

D is the correct answer. Justification The system developer will have specific knowledge in limited areas but will not have full knowledge of the business issues that affect the level of security required. The security manager’s responsibility is to ensure that the level of protection required by the data owner is provided. The custodian provides the level of protection required by the owner. Data owners are the most knowledgeable of the security needs of the business application for which they are responsible.

Answer 73

C is the correct answer. Justification The data custodian is responsible for the maintenance and protection of data. This role is usually filled by the IT department. The chief information security officer is responsible for security operations and management and for carrying out senior management’s directives. Responsibility for all organizational assets, including information, falls to the board of directors, which is tasked with responding to issues that affect information protection. The chief information officer is responsible for information technology within the enterprise but is not ultimately legally responsible for an enterprise’s information.

Answer 74

B is the correct answer. Justification Multilevel policies are based on classifications and clearances. A role-based policy will associate data access with the role performed by an individual, thus restricting access to data required to perform the individual’s tasks. Discretionary policies leave access decisions to be made by the information resource managers. Mandatory access control requires a clearance equal to or greater than the classification level of the asset. It generally also includes the need to know.

Answer 75

B is the correct answer. Justification An information security manager will coordinate and execute the implementation of the role-based access control. Data owners are in the best position to validate access rights to users due to their deep understanding of business requirements and of functional implementation within the application. This responsibility should be enforced by the policy. A data custodian will ensure that proper safeguards are in place to protect the data from unauthorized access; it is not the data custodian’s responsibility to assign access rights. Business management is not, in all cases, the owner of the data.

Answer 76

B is the correct answer. Justification The board is typically not essential in selecting particular technical solutions. The insurance policies that enterprises typically obtain to shield owners and key stakeholders from liability frequently require a good-faith effort on the part of the board to exercise due care as a precondition for coverage. If the board is not involved, this liability protection may be lost. Compliance is addressed as part of the risk management program. The board sets goals, for which strategies are then developed by senior management or subordinate steering committees.

Answer 77

B is the correct answer. Justification Senior management will have to ensure that the business manager has a clear understanding of the risk assessed, but it will not be in a position to decide on specific controls. The business manager will be in the best position, based on the risk assessment and mitigation proposals, to decide which controls to implement, in line with the business strategy and budget. The IT audit manager will take part in the process of identifying threats and vulnerabilities and make recommendations for mitigation. The information security officer could make some decisions regarding implementation of controls. However, the business manager will have a broader business view and better understanding of control impact on the business goals and, therefore, will be in a better position to make strategic decisions.

Answer 78

C is the correct answer. Justification Evaluation of vendors is the responsibility of the information security manager; however, this is not a role for senior management in supporting information security. Senior management may be involved in vendor evaluation in some enterprises, but its primary role is in setting the enterprise’s business direction, oversight and governance. Assessment of risk is the responsibility of the information security manager and this is not a role for senior management in supporting information security. Policies are a statement of senior management intent and direction that should be approved by senior management. It should also provide sufficient funding to achieve the enterprise’s information security objectives. This is the most appropriate role for senior management in supporting information security. The development of standards that meet the policy intent is typically a function of the information security manager and this is not a role for senior management in supporting information security.

Answer 79

B is the correct answer. Justification The IT steering committee is an executive management–level committee that assists in the delivery of the IT strategy, oversees day-to-day management of IT service delivery and IT projects, and focuses on implementation aspects. Data owners determine the level of controls deemed necessary to secure data and the applications that store or process the data. System owners are responsible for platforms, rather than for applications or data. The IT auditor evaluates the adequacy, efficiency and effectiveness of controls.

Answer 80

D is the correct answer. Justification Updating platform-level security settings would typically be performed by lower-level personnel because this is a basic task for IT administrators. Conducting disaster recovery test exercises would typically be performed by operational personnel belonging to the BCP/DR teams and various functions. Approving access to critical financial systems would be the responsibility of the data owner. Developing a strategy for information security would be the most appropriate task for the chief information security officer.

Answer 81

B is the correct answer. Justification Defining security metrics should take place after control objectives are determined and a strategy is developed. When establishing an information security program, conducting a risk assessment is key to identifying the needs of the enterprise and developing a security strategy. A gap analysis would be used after the desired state of security and the current state are determined to assess what needs to be done to fill the gap. Procuring security tools is a subsequent consideration.

Answer 82

D is the correct answer. Justification Inferred connections to business objectives are not as good as traceable connections. Standardized controls may or may not be relevant to a particular business objective. Addressing and managing constraints is not as useful alone as with the addition of defining explicit benefits. The security strategy is most useful if there is a direct traceable connection with business objectives.

Answer 83

C is the correct answer. Justification Active participation by a steering committee made up of business owners or their delegates is one way to accomplish strategic alignment, but a steering committee is not the only way to achieve this goal. If an enterprise has a strategic planning business unit, active participation in its activities may provide insight into future business directions and ensure that security considerations are included in the planning progress, but strategic alignment of the information security program does not require creation of such a unit. Alignment of the information security program requires an understanding of business plans and objectives as determined by business owners. Although the method of achieving regular interaction with business owners can vary based on the size and structure of an enterprise, the interaction itself is a requirement. Alignment of an information security program must take into account culture and existing technology, but information security supports the business objectives of the enterprise, which may include changes to the culture and technology currently in place. These aspects of the enterprise should not be accepted as foundations for program alignment when they are misaligned with business objectives.

Answer 84

B is the correct answer. Justification While systems thinking is essential to developing a sound systems architecture, it is not a prescriptive approach. A systems approach for developing information security includes the understanding that the whole is more than the sum of its parts, and that changes in any one part affect the rest. Alignment with business objectives is one of the desired outcomes, but systems thinking does not ensure it. Systems thinking is not a framework for information security governance, although the systems approach can be helpful in implementing an effective information security governance framework and information security management program.

Answer 85

A is the correct answer. Justification The security strategy will typically cover a wide variety of issues, processes, technologies and outcomes that can best be described by a set of desired characteristics and attributes. Control objectives are a function of acceptable risk determination and one part of strategy development, but the desired state of the information security function is a better tool. Mapping IT to key business processes must occur as one part of strategy implementation but it is an operational activity and not a way to describe strategy objectives. Calculation of annual loss expectations is not a way to describe the objectives in the information security strategy.

Answer 86

D is the correct answer. Justification Establishing security metrics and performance monitoring is very important to the extent that they indicate the achievement of security objectives, but this is only one aspect of the primary requirement to support business objectives. Educating business process owners is subordinate to supporting the business objectives and is only incidental to developing an information security strategy. Meeting legal and regulatory requirements is just one of the objectives of the strategy needed to support business objectives. The purpose of information security in an enterprise is to assist the enterprise in achieving its objectives, and it is the primary goal of an information security strategy.

Answer 87

A is the correct answer. Justification The purpose of the strategy is to set out the goals of the information security program and the plan to achieve those objectives. A strategy is usually too high level to deal specifically with control configuration. Some elements of strategy may deal with required behaviors and actions, but it will not be a mandate; rather, it will be part of a process to achieve a particular objective. Strategy will not deal with authorizing specific actions.

Answer 88

C is the correct answer. Justification An IT governance framework guides the development and management of a comprehensive information security program that supports clear and identified organizational objectives. Policies and procedures should be implemented after defining information security governance objectives. Information security governance aligns all security initiatives, plans and activities with the enterprise’s strategic goals. Governance assures resources are optimized for achieving the enterprise’s objectives. Therefore, understanding the organizational objectives would be the first step in effective information security governance. A security strategy is developed after the establishment of clear organizational objectives.

Answer 89

C is the correct answer. Justification Adopting suitable security standards is based on the implementation of the intent of the policies and is not the first step, as it follows the development of policies that support the strategy. Security baselines are established as a result of determining acceptable risk. Their determination is not the first step in implementing information security, which is taken up as a requirement prior to strategy development. Security governance is based on the information security strategy, which is the first step in the implementation. An information security strategy that meets and supports business objectives must be developed first. Policies are an instrument for governance and are developed to support the strategy; policies are not the first among activities undertaken to implement information security governance.

Answer 90

C is the correct answer. Justification Policies may specify some requirements, but policies are developed during implementation of the strategy. The architecture must implement the policies and standards. The strategy must initially define the requirements for the resources necessary to implement the program. This is different from the tactical detail level necessary to identify specific resources. Procedures will define resource acquisition processes but will not specify requirements.

Answer 91

C is the correct answer. Justification The chief technology officer will support the strategy but is not the person who would generally approve it. The long-term IT plan in part implements the information security strategy. The strategy is the plan to achieve objectives. The board of directors sets the objectives. Key performance indicators are used to measure the milestones necessary to achieve goals.

Answer 92

B is the correct answer. Justification Key business controls are only one part of a security strategy and must be related to business objectives. A set of security objectives supported by processes, methods, tools and techniques constitutes a security strategy. Firewall rule sets, network defaults and intrusion detection system settings are technical details subject to periodic change and are not appropriate content for a strategy document. Budgets will generally not be included in an information security strategy. Additionally, until the information security strategy is formulated and implemented, specific tools will not be identified and specific cost estimates will not be available.

Answer 93

C is the correct answer. Justification Policies do not change as frequently as procedures and standards; however, security policies do change to adjust to new regulations or laws, to respond to organizational changes, or to address emerging technology trends. These changes do not typically require adjustments to the information security strategy. Standards change more frequently because they must often be adjusted to allow for changes in technology and business processes. Of the choices provided, the information security strategy is the least likely to change. An information security strategy is a reflection of high-level objectives and the direction of the security program, as dictated by business leadership. Information security policies, standards and procedures are derived from the information security strategy. Procedures change more frequently because they must often be adjusted to allow for changes in technology and business processes.

Answer 94

A is the correct answer. Justification The overall objective of an information security strategy is to support business objectives and activities and minimize disruptions. Maximizing the effectiveness of resources is one of the factors in developing a strategy but is secondary to supporting organizational activities. The strategy must consider legal and regulatory requirements, but they are just one category of potential impact considerations. Organizational structure affects the approaches to developing a strategy but is just one of the considerations.

Answer 95

B is the correct answer. Justification Staffing requirements stem from the implementation time lines and requirements of the strategic plan. It is most important to present a vision for the future and then create a road map from the current state to the desired future state based on a gap analysis that will identify the requirements to achieve the future state. IT capital investment requirements are generally not determined at the strategic plan level but rather from a financial assessment and operational evaluation of the capital assets required to achieve the objectives of the strategic plan. The mission statement is typically a short, high-level aspirational statement of overall organizational objectives and only directly affects the information security strategy by setting the context.

Answer 96

B is the correct answer. Justification Justification for program costs will need to be achieved prior to developing the strategy and is more likely based on a business case than on the strategy. A strategy is a plan to achieve an objective that serves to align and integrate program activities to achieve the defined outcomes. Management support will need to be achieved prior to developing the strategy and is more likely based on a business case than on the strategy. Compliance with international standards, such as International Organization for Standardization (ISO) 27001, does not necessarily require a cohesive plan of action or strategy and can be done piecemeal. If meeting the standard is one of the objectives, a strategy should encompass the actions needed to meet those requirements.

Answer 97

C is the correct answer. Justification An internal auditor is a good advocate but is secondary to the influence of senior management. The chief operating officer will be a member of the steering committee. Senior management represented in the security steering committee is in the best position to advocate the establishment of, and continued support for, an information security program. IT management has a lesser degree of influence and would also be part of the steering committee.

Answer 98

C is the correct answer. Justification Functional goals and security goals need to be aligned at the operational level, but neither are derived from the other. Security is not an end in itself and should serve the overall business goals. As such, business goals are not derived from security goals. Security goals should be derived from business goals, which are developed based on the overall business strategy. This is the most important relationship, as it depends on business strategy defined by top management. If security goals are defined independently of business goals, the security function would not support the overall business strategy, or it might hinder the achievement of overall business objectives.

Answer 99

A is the correct answer. Justification The information security manager is responsible for developing a security strategy based on business objectives with the inputs from business process owners. Reviewing the security strategy is the responsibility of a steering committee or top management. The information security manager is not necessarily responsible for communicating the security strategy. Management or the security steering committee has the responsibility to approve and fund the security strategy implementation.

Answer 100

A is the correct answer. Justification Information security exists to minimize business disruptions and support the achievement of organizational objectives. When the services provided reflect the requirements of key business stakeholders, alignment is primarily achieved. The IT executive team is just one of the stakeholders, and its desires may not reflect the requirements of the rest of the enterprise. Good practices may be excessive or insufficient for a particular enterprise and do not ensure alignment of information security with business. Services should be reliable and cost-effective but that would not ensure alignment with business objectives.

Answer 101

D is the correct answer. Justification An information security strategy is important for creating the information security program and cannot be its objective. Establishing incident response procedures is important, and it is a component of an information security program but not its primary objective. Cost-effective security solutions are essential but are not the objective of security program development. Reducing risk to and impact on the business is the most important objective of an information security program.

Answer 102

A is the correct answer. Justification The purpose of the strategy is to set out the goals of the information security program and the plan to achieve those objectives. A strategy is usually too high level to deal specifically with control configuration. Some elements of strategy may deal with required behaviors and actions, but it will not be a mandate; rather, it will be part of a process to achieve a particular objective. Strategy will not deal with authorizing specific actions.

Answer 103

D is the correct answer. Justification Any planning for information security should be properly aligned with the needs of the business, not necessarily the IT strategic plan. Technology needs should not come before the needs of the business and one cannot base the information security strategy on the current rate of technological change, without ascertaining whether it aligns with business needs. Planning should not be done on an artificial timetable that ignores business needs—a timeline of three to five years needs to be justified and seems to be arbitrary. Any plans for information security should be aligned with the business strategy.

Answer 104

A is the correct answer. Justification Without defined objectives, the information security strategy and plan to achieve objectives cannot be developed, so defined objectives are the most important element. Time frames for delivery are important but not critical in the strategy document development process. The adoption of a control framework is not critical prior to developing an information security strategy. Policies are developed during and after strategy implementation; they are not prerequisites for developing the information security strategy.

Answer 105

B is the correct answer. Justification A positive security environment (culture) enables successful management of the security implementation but is not important in developing a security strategy. Understanding key business objectives is most important in developing a security strategy because the business strategy drives security. A reporting line to senior management is not important in developing a security strategy. It is needed to ensure senior management is informed about security initiatives and to ensure its commitment. Allocation of resources is a factor of high importance in the development of a security strategy.

Answer 106

C is the correct answer. Justification The availability of resources is a factor in developing and implementing the program but is not a consideration for developing an information security strategy. Legal and regulatory requirements should be considered in the strategy to the extent management determines the appropriate level of compliance, but it is not the most important consideration. Effectively managing information risk to acceptable levels (in alignment with the business objectives) is the most important overall consideration of an information security strategy. The resource requirements to implement the strategy is a consideration but a secondary one.

Answer 107

B is the correct answer. Justification Consistency of document design facilitates maintenance, while consistency of document content across units and entities ensures that documents are applied uniformly; consistency does not ensure alignment with business objectives. Residual risk is the remaining risk after management has implemented a risk response or treatment. An important objective of a security strategy is to implement cost-effective controls that ensure that residual risk remains within the enterprise’s acceptable risk and tolerance levels. Most threats cannot be affected by policy; however, risk likelihood and impact can be affected. Standard controls may or may not be relevant to a particular business objective.

Answer 108

C is the correct answer. Justification Identification of information assets and asset ownership is a good starting point for implementing an information security strategy. However, having a clear objective is essential. Valuation of information assets is best performed after the asset inventory has been compiled and the asset owners are assigned. Asset owners generally classify assets according to the enterprise’s asset classification scheme. Asset classification represents the business value of the asset to the enterprise and is the basis for the required protection levels. Determining the objectives of information security provides the basis for a plan to achieve those objectives, which is the definition of a strategy. Asset classification represents the business value of the asset to the enterprise and is the basis for the required protection levels.

Answer 109

B is the correct answer. Justification Policy is an executive mandate on strategy to achieve objectives, so the objectives must be established first. Just as any organizational support program exists to achieve organizational objectives, an information security program must begin with a complete and accurate description of those objectives. While an inventory of business applications may be useful in establishing a security program, enumerating organizational objectives should be completed at an earlier stage in order to define the critical business functions. Security awareness should be customized to organizational requirements and roles and responsibilities, so it relies on prerequisite strategy and policy based on organizational objectives.

Answer 110

C is the correct answer. Justification An internal auditor is a good advocate but is secondary to the influence of senior management. The chief operating officer will be a member of the steering committee. Senior management represented in the security steering committee is in the best position to advocate the establishment of, and continued support for, an information security program. IT management has a lesser degree of influence and would also be part of the steering committee.

Answer 111

B is the correct answer. Justification Industry frameworks are useful in improving security implementation to the extent that they align with and support business objectives. The most critical factor to be considered in defining information security requirements is the business strategy because everything that the business does—including information security—is only done for the sake of pursuing the business strategy. Security requirements are driven by the information security policy, procedures and practices. The technology infrastructure needs to be considered while implementing security, but if the current infrastructure cannot support information security requirements that are aligned with the business strategy, then the infrastructure will also need to be reevaluated. User competencies reflect a current state and may be useful in mapping a path forward for the lowest cost, but competencies can be enhanced by providing training to bring users to the required level. The business strategy is the driver of information security requirements (and all other activities).

Answer 112

D is the correct answer. Justification Technology constraints are not the primary drivers for information security governance, though they may be considered in developing governance and planning the strategy. Regulatory requirements are not the primary drivers of information security governance, though these requirements are addressed by governance and may affect how the governance strategy develops. Litigation potential is usually an aspect of liability risk and a consideration for information security governance but it is not a primary driver. Business strategy is the primary driver of information security governance because security must align with the business objectives of the enterprise, as set forth in the business strategy.

Answer 113

B is the correct answer. Justification The task of identifying business risk that affects the enterprise is assigned and acted on after establishing the need for creating the program. In developing an information security management program, the first step is to establish the need for creating the program. This is a business decision based more on judgment than on any specific quantitative measures. The other choices are assigned and acted on after the need is established. The task of assigning responsibility for the program follows establishing the need for creating the program. The task of assessing the adequacy of existing controls follows establishing the need for creating the program.

Answer 114

C is the correct answer. Justification Functional goals and security goals need to be aligned at the operational level, but neither are derived from the other. Security is not an end in itself and should serve the overall business goals. As such, business goals are not derived from security goals. Security goals should be derived from business goals, which are developed based on the overall business strategy. This is the most important relationship, as it depends on business strategy defined by top management. If security goals are defined independently of business goals, the security function would not support the overall business strategy, or it might hinder the achievement of overall business objectives.

Answer 115

A is the correct answer. Justification Enterprises must manage risk to a level that is relative to, and acceptable for their business model, goals and objectives. A zero-level approach may be costly and may not provide the effective benefit of additional revenue to the enterprise. Long-term maintenance of this approach may not be cost-effective. Further, risk levels cannot be zero. Risk varies as business models and geography, regulatory and operational processes change. Besides, all risk cannot be avoided and appropriate controls will have to be enabled as part of the information security strategy. Insurance is generally used to protect against low-probability high-impact events and requires that the enterprise have certain operational controls in place to mitigate risk in addition to generally high deductibles. Therefore, transferring most risk is not cost-effective.

Answer 116

B is the correct answer. Justification Staffing requirements stem from the implementation time lines and requirements of the strategic plan. It is most important to present a vision for the future and then create a road map from the current state to the desired future state based on a gap analysis that will identify the requirements to achieve the future state. IT capital investment requirements are generally not determined at the strategic plan level but rather from a financial assessment and operational evaluation of the capital assets required to achieve the objectives of the strategic plan. The mission statement is typically a short, high-level aspirational statement of overall organizational objectives and only directly affects the information security strategy by setting the context.

Answer 117

D is the correct answer. Justification Establishing security metrics and performance monitoring is very important to the extent that they indicate the achievement of security objectives, but this is only one aspect of the primary requirement to support business objectives. Educating business process owners is subordinate to supporting the business objectives and is only incidental to developing an information security strategy. Meeting legal and regulatory requirements is just one of the objectives of the strategy needed to support business objectives. The purpose of information security in an enterprise is to assist the enterprise in achieving its objectives, and it is the primary goal of an information security strategy.

Answer 118

C is the correct answer. Justification Adopting suitable security standards is based on the implementation of the intent of the policies and is not the first step, as it follows the development of policies that support the strategy. Security baselines are established as a result of determining acceptable risk. Their determination is not the first step in implementing information security, which is taken up as a requirement prior to strategy development. Security governance is based on the information security strategy, which is the first step in the implementation. An information security strategy that meets and supports business objectives must be developed first. Policies are an instrument for governance and are developed to support the strategy; policies are not the first among activities undertaken to implement information security governance.

Answer 119

A is the correct answer. Justification The security strategy will typically cover a wide variety of issues, processes, technologies and outcomes that can best be described by a set of desired characteristics and attributes. Control objectives are a function of acceptable risk determination and one part of strategy development, but the desired state of the information security function is a better tool. Mapping IT to key business processes must occur as one part of strategy implementation but it is an operational activity and not a way to describe strategy objectives. Calculation of annual loss expectations is not a way to describe the objectives in the information security strategy.

Answer 120

A is the correct answer. Justification While defining the information security strategy, it is essential to align it with the business and the IT strategy. The security manager must first focus on understanding the business and the IT strategy. Investigating baseline security is a task associated with strategy implementation. Defining the information security policy is performed after defining security strategy. Risk assessment is performed to determine the control objectives. It is generally performed after the security strategy is defined.

Answer 121

D is the correct answer. Justification Emerging technology may help bring an enterprise up to current standards, but it may not be part of the enterprise’s goals or mission. Handling or preventing system compromises is important but is not the influence that will affect content of the information security strategy as it is most likely to affect control design and implementation. The network architecture is not the influence that will affect content of the information security strategy, as it is an operational design that must support the security strategy. The information security strategy will be influenced by organizational goals, as objectives should be aligned with business.

Answer 122

D is the correct answer. Justification Audit reports may indicate areas of security activity that do not optimally support the enterprise objectives, but they will not be as good an indicator as insight from business owners. Losses may or may not be considered acceptable by the enterprise but will not be well correlated with the perception of business support. To the extent that business cases have been developed for particular security activities, they will be a good indication of how well business requirements were considered; however, the perception of business owners will ultimately be the most important factor. It is essential that business owners understand and support the security program and fully understand how its controls impact their activities. This can be most readily accomplished through direct interaction with business leadership.

Answer 123

C is the correct answer. Justification Security awareness training, although important, is secondary. Achievable goals and objectives are important but will not ensure success if senior management support is not present. Sufficient senior management support is the most important factor for the success of an information security program. Having adequate budget and staffing is important, but in the unlikely event they existed without senior management support, they would not by themselves ensure success.

Answer 124

A is the correct answer. Justification Information security priorities may sometimes override technical specifications, which then must be rewritten to conform to minimum security standards. Regulatory requirements are government-mandated and, therefore, not subject to override. Privacy requirements are usually government-mandated and, therefore, not subject to override. The needs of the business should always take precedence in deciding information security priorities.

Answer 125

B is the correct answer. Justification Alignment with business objectives will help prioritize information security program objectives and what the program will focus on as it is developed. Building an asset inventory will help determine what the enterprise needs to protect and sets the scope for the information security program. The risk matrix will not be accurate if the assets are resources that are unknown. A risk assessment relies on the identification of assets in an enterprise.

Answer 126

C is the correct answer. Justification The scope of the program must be determined before asset identification can be performed. The scope of the program must be determined before a risk assessment can be performed. The scope of the program must be determined before any of the other steps can be performed. The scope of the program must be determined before a business impact analysis can be performed.

Answer 127

A is the correct answer. Justification A security review is used to determine the current state of security for various program components. An impact assessment is used to determine potential impact in the event of the loss of a resource. Vulnerability is only one specific aspect that can be considered in a security review. A threat analysis would not normally be a part of a security review.

Answer 128

B is the correct answer. Justification Industry good practices may serve as a guideline but may be excessive or insufficient for a particular enterprise. The security architecture, most importantly, must be aligned with business goals and objectives. Information technology plans are created once the architecture and strategy are in place and are aligned with business goals and objectives by default. International frameworks can serve as a general guide to the extent they support business goals and objectives.

Answer 129

C is the correct answer. Justification Policies and standards are among the primary tools to implement a strategy and are subsequent steps in the process. Implementing the information security strategy is the activity that populates or develops the governance framework. Because a strategy is essentially a plan to achieve an objective, it is essential to know the current state of information security and the desired future state or objectives. Management intent and direction are essential to developing objectives; the current state is also required.

Answer 130

A is the correct answer. Justification The information security manager is responsible for developing a security strategy based on business objectives with the inputs from business process owners. Reviewing the security strategy is the responsibility of a steering committee or top management. The information security manager is not necessarily responsible for communicating the security strategy. Management or the security steering committee has the responsibility to approve and fund the security strategy implementation.

Answer 131

B is the correct answer. Justification Assessing and analyzing risk is required to develop a strategy and will provide some of the information needed to develop it, but will not define the scope and charter of the security program. Also, how the enterprise chooses to approach identified risk is a business decision that must be made by senior management and identified in a strategy. An effective information security strategy provides clear direction on how the enterprise will attain security outcomes desired and directed by senior management. A security architecture is ideally a part of implementation after developing the strategy. It is possible to adopt an architecture without a strategy, but its implementation will not necessarily help the enterprise to attain the security outcomes desired by senior management. The applicability statement is a part of strategy implementation using International Organization for Standardization (ISO) 27001 or 27002 after determining the scope and responsibilities of the program. Like a security architecture, an applicability statement can be adopted without a strategy, but will not necessarily help the enterprise to attain the security outcomes desired by senior management.

Answer 132

A is the correct answer. Justification Achieving and maintaining strategic alignment means that business process owners and managers believe that information security is effectively supporting their organizational activities. This can most easily and inexpensively be determined by periodic surveys, which will also indicate improvement or degradation over time. Implementing an appropriate governance framework may improve strategic alignment in addition to a number of other benefits, but it is exceedingly complex, time-consuming and expensive and may not directly capture business owners’ perceptions or show changes over time. While important, controls meeting objectives may not be perceived by managers as helpful to the business and may, in fact, be seen as an impediment to their activities. An enterprise architecture should consider business objectives during design and development, but in an effort to balance many other requirements, such as security and functionality, it may or may not be perceived as supporting business activities.

Answer 133

D is the correct answer. Justification Policies may require that baselines be defined, but the specifics will be in the standards. Acceptable risk will define the control objectives, which are then expressed in the standards. Potential impacts will help determine acceptable risk expressed in the standards, which collectively set the baseline. Standards taken together define the lowest limits of security, thereby defining the baseline.

Answer 134

D is the correct answer. Justification Corporate standards are established on the basis of policies that support organizational strategy. Complying with corporate standards is only one aspect of developing governance. While the cost-effectiveness of risk mitigation approaches is an important consideration, aspects of information security governance cannot be implemented if they are contrary to organizational goals. Consensus is valuable, but not required. Information security governance is the set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risk is managed appropriately, and verifying that the enterprise’s resources are used responsibly. It should support and reflect the goals of the enterprise.

Answer 135

D is the correct answer. Justification Monitoring and metrics can determine progress but are effective only if there is management support. Strategy is only one building block of information security governance and cannot work without management support. A steering committee cannot exist without management support. Senior management must champion the process and information security spokespersons to create an effective information security governance framework.

Answer 136

D is the correct answer. Justification A capability maturity model may not include business objectives; in that case, it would not provide a complete perspective, being more focused on security objectives. While providing greater detail into processes and capabilities, a process assessment model only provides a process-focused view rather than a multidimensional one covering business and security. A risk assessment is used to identify vulnerabilities and controls and does not address alignment of security with business objectives. A business balanced scorecard will align information security goals with business goals and provide a multidimensional view of both quantitative and qualitative factors.

Answer 137

B is the correct answer. Justification Security awareness training will promote the security policies, procedures and appropriate use of the security mechanisms but will not precede information security governance implementation. Updated security policies are required to align management business objectives with security processes and procedures. Management objectives translate into policy; policy translates into standards and procedures. An incident management team will not be the first requirement for the implementation of information security governance and can exist even if formal governance is minimal. Information security governance provides the basis for architecture and must be implemented before a security architecture is developed.

Answer 138

D is the correct answer. Justification While adequately protecting information and the knowledge base is important, governance is ultimately about achieving business objectives. Unless information security strategy is aligned with business objectives, there is no basis to determine the adequacy of the security posture. Information security governance is more than IT systems. Governance ensures that business objectives are achieved by evaluating stakeholder needs, conditions and options; setting direction through prioritization and decision-making; and monitoring performance, compliance and progress against plans.

Answer 139

B is the correct answer. Justification Frameworks are beneficial as a means of tracking what functions should be performed by effective governance, but the establishment of governance is primarily a matter of understanding business objectives. The governance program needs to be a comprehensive security strategy intrinsically linked with business objectives. It is impossible to build an effective program for governance without understanding the objectives of the business units, and the objectives of the business units can best be understood by examining their processes and functions. Meeting regulatory and legal requirements may be included among the objectives of the business, but compliance with laws and regulations is not the primary function of information security governance. Depending on the cost associated with doing so, businesses may, in some cases, even opt to accept the risk of noncompliance. Governance reflects the approach to achieving the objectives of the business. Meeting with the security functions can only provide insight with regard to the technical posture and goals as they currently exist; it does not provide a basis on which to build a program.

Answer 140

D is the correct answer. Justification It is expected that the enterprise will start work to improve the system beyond this level. It is not wrong for an enterprise to start off at the base of the maturity model. This method could be unnecessarily expensive if not well planned and may result in conflicts between the frameworks. It is very important that qualitative and quantitative objectives be well-defined for a gap analysis to be effective. However, defining a desired state without input from the business strategy invalidates the entire process. Risk management is about the business. Defining a desired state without consideration of business objectives implies that the stated desired outcome may not be effective, even if attained.

Answer 141

D is the correct answer. Justification A SWOT analysis addresses strengths, weaknesses, opportunities and threats. Although useful, a SWOT analysis is not as effective a tool as a balanced scorecard (BSC). A waterfall chart is used to understand the flow of one process into another. A gap analysis, while useful for identifying differences between the current state and the desired future state, is not the most appropriate tool. A BSC is most effective for evaluating the degree to which information security objectives are being met.

Answer 142

D is the correct answer. Justification Assessing and analyzing risk is required to develop a strategy and will provide some information needed to develop it but will not define the scope and charter of the security program. A physical security architecture is a part of an implementation. The applicability statement is a part of the strategy implementation using International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 27001 or 27002 after determining the scope and responsibilities of the program. The process of developing information security governance structures, achieving organizational adoption and developing a strategy to implement will define the scope and responsibilities of the security program.

Answer 143

B is the correct answer. Justification The likelihood of an adverse event and the consequences of such an event will define the risk, but only the risk appetite will indicate if the risk is acceptable. Risk appetite is the amount of risk, on a broad level, that an entity is willing to accept in pursuit of its mission. The risk appetite sets the acceptable limits for organizational standards. Standards interpret policy, but boundaries are set based on risk. Standards are a part of implementing strategy, but boundaries are set based on risk.

Answer 144

D is the correct answer. Justification Interoperability is important but without merit if a technologically elegant solution is achieved that does not meet the needs of the business. Scalability is important but only to the extent the architecture meets stakeholder requirements. There are a number of viable developmental methodologies, and the choice of which is used is not particularly important as long as it meets the needs of the enterprise. The most important factor for information security architecture design is that of safeguards for stakeholder requirements as defined by business needs.

Answer 145

C is the correct answer. Justification Procedures will not indicate the appropriateness of control mechanisms. The business process flow is not relevant to the access control mechanism. IT management should ensure that mechanisms are implemented in line with IT security standards. The enterprise’s own policies, standards and procedures should take into account regulatory requirements.

Answer 146

B is the correct answer. Justification Governance costs may or may not be reduced, but that is not the primary objective. The overarching objective of governance, risk and compliance (GRC) is improved risk management achieved by integrating interrelated activities across the enterprise, primarily focused on finance, legal and IT domains. Convergence of security activities would be just one element of GRC. Achieving an appropriate level of regulatory compliance is likely to be one of the goals, but with the overall objective of more effective and efficient management of risk.

Answer 147

B is the correct answer. Justification Processes support an information security program’s implementation and management but by themselves are not as useful as a framework. Adoption of a framework, such as the International Organization for Standardization (ISO) 27001 or COBIT, is the best and most widely recognized approach to information security program development. A reference model is one approach to developing an information security program, but it is less flexible than a framework. Guidelines assist an information security program’s implementation and management but by themselves are not as useful as a framework.

Answer 148

A is the correct answer. Justification To improve the governance framework and achieve a higher level of maturity, an enterprise needs to conduct continuous analysis, monitoring and feedback, comparing the desired state of maturity to the current state. Return on security investment may show the performance result of the security-related activities in terms of cost-effectiveness; however, this is not an indication or consideration for the maturity model concept. Continuous risk reduction demonstrates the effectiveness of the security governance framework but is not an indication or consideration for the maturity model concept. A key risk indicator setup is a tool to be used in internal control assessment, and it presents a threshold to alert management when controls are being compromised in business processes. This is a control tool rather than a consideration to support maturity models.

Answer 149

C is the correct answer. Justification IT risk is part of the broader risk landscape and must be integrated into overall risk management activities. To ensure an objective, holistic approach, IT risk management must be addressed on an enterprise-wide basis, separate from the IT department. IT is an enabler of business activities; to be effective, it must be integrated into business processes. Communication alone does not necessarily correlate with successful execution of a process.

Answer 150

C is the correct answer. Justification One of the outcomes of governance, risk and compliance (GRC) is the increased attention on general controls, because they are more pervasive and cost-effective than application-level controls. However, the primary driver for GRC is the increased complexity and diversity of assurance requirements and the need to address them through one integrated process. As with most information security activities, appropriate policy support is needed for effective GRC implementation, but that is only one aspect of achieving integration. GRC is a process to integrate multiple disparate but related activities to improve effectiveness, reduce or eliminate conflicting approaches, and reduce costs. GRC is not a model, but an approach to achieving greater assurance process integration.

Answer 151

B is the correct answer. Justification Protecting data is not as important as protecting life. For physical controls, such as electrically controlled doors with swipe card access, the most important consideration is safety, such as ensuring that the doors will not fail to open in case of fire. The control policy is part of the information security strategy. Compliance with regulatory requirements, where relevant, is important, but ultimately, the safety of people has the highest priority.

Answer 152

A is the correct answer. Justification Standards set the allowable boundaries for procedures to ensure they comply with the intent of policies. Guidelines are a description of a particular way of accomplishing something that is less prescriptive than a procedure. Security metrics will detect but not necessarily ensure alignment between policies and procedures. Gap analysis is used to determine what is required to move from an existing state to a desired state but is not useful in determining the alignment of procedures and policy.

Answer 153

C is the correct answer. Justification An internal auditor is responsible for the audit function and does not have the authority to approve plans to implement the information security governance framework. Information security management is responsible for security operations and should not have the authority to approve the security governance framework. Senior management that is part of the security steering committee is the best authority to approve plans to implement an information security governance framework. Infrastructure management is not in the best position because it focuses more on the technologies than on the business.

Answer 154

A is the correct answer. Justification Governance, risk and compliance (GRC) is an effort to integrate assurance activities across an enterprise to achieve greater efficiency and effectiveness. It is unlikely that all three activities would not be covered by policies, but GRC may unify existing policies to reduce complexity and any differences that exist. GRC deals directly with sequence of security activities and all three may occur concurrently. GRC is about integration of security activities, not specific responsibilities of various groups.

Answer 155

C is the correct answer. Justification A risk assessment should be carried out for making a business case to obtain management support, but the risk assessment by itself will not be effective. Informing management of regulatory requirements may help gain support for initiatives but given that many enterprises are not in compliance with regulations, it is unlikely to be sufficient. A complete business case, including a cost-benefit analysis, will be most persuasive to management. Good metrics that provide assurance that initiatives are meeting organizational goals will be useful but are not likely to be sufficient for gaining management support.

Answer 156

B is the correct answer. Justification Vulnerability assessments are useful, but they do not provide information that can help determine whether the cost of the technology is justified. Investments in security technologies should be based on a value analysis and a sound business case. Value analysis provides an assessment that the product features help address the business case and that the cost is no greater than the impact of the security risk being mitigated. Demonstrated value takes precedence over the current business because the climate is continually changing. Basing decisions on audit recommendations alone would be reactive in nature and might not address the key business needs comprehensively.

Answer 157

B is the correct answer. Justification In a business case, there is no need to explain technology issues of security. Business cases are prepared on the basis of business value and benefits to the enterprise. This is usually difficult for security managers to identify and present effectively. Simulating various risk scenarios must be done as part of risk assessment, but these are not usually included in a business case. Benchmarking data is an approach to value demonstration and does not present a significant challenge to support the business case.

Answer 158

C is the correct answer. Justification Prioritizing security activities is always useful but eliminating any security services, even low-priority, should be a last resort. If budgets are seriously constrained, management is already addressing increases in other risk and is likely to be aware of the issue; a proactive approach to doing more with less will be well-received. Allocating resources to the areas of highest risk and benefit and educating management on the potential consequences of underfunding is the best approach. Reducing monitoring activities may unnecessarily increase risk when lower-cost options to perform those functions may be available.

Answer 159

C is the correct answer. Justification The impact on the risk profile can be one component of the business case but does not include all the areas the business case would cover. The basis for acceptance among the directors should be the impact on the risk profile. A business case is defined as documentation of the rationale for making a business investment, used both to support a business decision on whether to proceed with the investment and as an operational tool to support management of the investment through its full economic life cycle. A business case covers not only long-term benefits, but also short-term ones, along with costs. While cost is important to consider, if the benefits outweigh the costs, it will be in the best interests of the enterprise to go ahead with the investment.

Answer 160

D is the correct answer. Justification One regular evaluation criterion for the appropriate selection of any security technology is its ability to cost-effectively reduce or eliminate business risk. Trade publication evaluations may not provide all information on the technology's abilities and may be written by sponsors or influencers. While new or emerging technologies may offer potential benefits, they are not time-tested, which reduces their acceptability as the primary selection basis. Investments in security technologies should be based on their overall value in relation to their cost; the value can be demonstrated in terms of risk mitigation.

Answer 161

C is the correct answer. Justification Budget justification is not a primary purpose of the investment decision; it acts as an input to the decision-making process. Return on investment is not a primary purpose of the investment decision; it acts as an input to the decision-making process. Providing explanations on how the proposed information security investment supports the achievement of organizational objectives provides senior management with an understanding of how the investment will add value to the enterprise and increase its chances of success. Regulatory and compliance requirements are an input, but the business goals are the primary driver of the decision-making process.

Answer 162

A is the correct answer. Justification There are many possible justifications for implementing a security solution; however, the key is to choose the most appropriate justification for the business case. The current risk profile may be one of a number of possible justifications and cannot, by itself, be the input for a complete business case. Regulatory requirements may be one of many possible justifications and cannot be the sole input for a complete business case. Incidents and losses are possible justifications for implementing security solutions and cannot be the sole input for a complete business case.

Answer 163

C is the correct answer. Justification While examples of incidents at other enterprises may help obtain senior management buy-in, the security program should be based on realistic threats to the enterprise’s corporate objectives. Good practices are useful, and they may be the foundation for the security program, which may enhance senior management buy-in. However, this may not be a substantial argument to obtain executive management commitment. Linking realistic threats to key business objectives will direct executive attention and provide the necessary understanding of the risk scenario for executive management to ensure their commitment to the security program. Analysis of current technological exposures may enhance senior management buy-in but the argument may not be as substantial as realistic threats to the enterprise’s corporate objectives.

Answer 164

C is the correct answer. Justification Risk analysis quantifies risk to prioritize risk responses. The annual loss expectancy is the monetary loss that can be expected for an asset due to a risk over a one-year period but does nothing to prioritize controls. Cost-benefit analysis is performed to ensure that the cost of a safeguard does not outweigh its benefit and that the best safeguard is provided for the cost of implementation. An impact analysis is a study to prioritize the criticality of information resources for the enterprise based on costs (or consequences) of adverse events. In an impact analysis, threats to assets are identified and potential business losses determined for different time periods. This assessment is used to justify the extent of safeguards that are required and determine recovery time frames. This analysis is the basis for establishing the recovery strategy.

Answer 165

D is the correct answer. Justification While benchmarking similar enterprises can be helpful in some instances to make a case for management support of the information security program, benchmarking by itself is not likely to be sufficient. Management often considers security to be a financial drain and over-reactive. Showing probable outcomes can help build a case, but demonstrating how the program will materially assist in achieving the desired business outcomes will be more effective. Due care is a legal requirement and best presented by the legal department. By itself, the due care requirement is not enough to translate the value of an information security program to management. The most effective approach to gain support from management for the information security program is to persuasively demonstrate how the program will help achieve the desired outcomes. This can be done by providing specific business support in areas of operational predictability and regulatory compliance, and by improving resource allocation and meaningful performance metrics.

Answer 166

B is the correct answer. Justification Time required for implementation is potentially one impact on the enterprise but is subordinate to the overall impact of the project on the enterprise. Prioritization of information security projects should be assessed on the basis of the positive impact that they will have on the enterprise. Total cost for implementation is one aspect of the information security project but is not the factor on which prioritization can be assessed. A mix of resources required may be a factor in delivery but it is not particularly relevant to prioritizing security projects.

Answer 167

A is the correct answer. Justification A business case is inclusive of the other options and specifically addresses them. A business case must enumerate the risk that the initiative will address. The value proposition is an essential part of the business case that addresses the financial aspects of the initiative. The business case must show how the initiative will align with and support organizational objectives.

Answer 168

C is the correct answer. Justification Assessing project feasibility involves a variety of factors that must be determined prior to issuing a request for proposal (RFP). An RFP is a document distributed to vendors asking them to submit a proposal to develop or provide a solution. Final management approval is likely to occur after receiving responses to an RFP. Development of a project budget depends on the responses to an RFP. The business case will be developed as a part of determining feasibility, which occurs prior to issuing an RFP.

Answer 169

B is the correct answer. Justification The impact on IT assets is an important component but by itself is insufficient to justify the information security program. A business case contains documentation of the rationale for making a business investment, used both to support a business decision on whether to proceed with the investment and as an operational tool to support management of the investment through its full economic life cycle. A business case will provide the justification for the information security program by demonstrating the benefits of implementation. Approval by the steering committee validates the justification contained in the business case. User acceptance is highly relevant during the system development life cycle; however, it is ill-advised to rely on user acceptance as justification for a security program, particularly because security and performance often clash.

Answer 170

B is the correct answer. Justification Ensuring that risk is identified and mitigated is not sufficient to qualify as the most important objective of the information security strategy, as one needs to consider all controls and business issues. The most important part of an information security strategy is that it supports the business objectives and goals of the enterprise. Maximizing return on information security investment can only be achieved if the information security strategy is aligned with the business strategy. Efficient utilization of resources at the enterprise level can only be achieved if the information security strategy is aligned with the business strategy.

Answer 171

C is the correct answer. Justification The risk assessment report provides the rationale for the business case for implementing a particular security solution. The technical evaluation report provides supplemental information for the business case. The information security manager needs to have knowledge of the development of business cases to illustrate the costs and benefits, or value proposition, of the security solution. Budgetary requirements provide part of the information required in the business case.

Answer 172

A is the correct answer. Justification Without management support, the program will never be able to establish a charter that will allow it to function within the environment. All the other choices follow the charter. Without a charter for the program, there will be no budget because the program will not exist. A charter is needed to establish the program before policy can be developed. The reporting structure will not be established until the program is chartered.

Answer 173

A is the correct answer. Justification External resources that can contribute cost-effective expertise that are not available internally represent the primary driver for the information security manager to make use of external resources. The information security manager will continue to be responsible for meeting the security program requirements despite using the services of external resources. The external resources should never completely replace the role of internal resources from a strategic perspective. The external resources cannot have a better knowledge of the business of the information security manager’s enterprise than do the internal resources.

Answer 174

A is the correct answer. Justification The best indicator of strategic alignment is the opinion of the business stakeholders—and the best way to obtain this information is to periodically obtain their feedback. Audits may indicate something is amiss, but audits do not have a direct correlation with the effectiveness of the information security program to support business goals and objectives. Incident losses may indicate the overall effectiveness of the program but may have more to do with inadequate budgets or staffing than with alignment. Business cases for security projects may indicate where alignment went astray. However, business cases are indirect, and an analysis would be too late to be useful as an indicator of alignment.

Answer 175

D is the correct answer. Justification Senior management would be responsible for escalating issues to relevant external third parties. Security is only one aspect of issues that may arise between parts of the enterprise, and authority to address issues must be at a higher level to arbitrate between conflicting requirements. It is unlikely that the security manager is in a position of authority to insist that business unit managers should accept the risk, and the matter should be escalated to senior management to issue such directives. Senior management is in the best position to arbitrate issues between organizational units because it will consider the overall needs of the business in reaching a decision.

Answer 176

A is the correct answer. Justification Senior management commitment is the most important prerequisite for establishing security management within the enterprise. Without senior management commitment, the seriousness of the security initiative is likely to be ignored within the enterprise. Without senior management commitment, an information security framework is not likely to be implemented. Without senior management commitment, it is not likely that there is support for developing an information security organizational structure. The development of effective policies as a statement of management intent and direction is likely to be inadequate without senior management commitment to information security.

Answer 177

A is the correct answer. Justification Senior management support is critical to the implementation of any security program. An appropriate budget for security activities is not likely without the support of senior management. Vulnerability assessments are an important element of a successful security program but will be of little use without management support for addressing issues that arise. Knowledgeable security administrators are important for a successful security program, but they are not likely to be effective without management support.

Answer 178

D is the correct answer. Justification Policies are developed or modified after a strategy is defined and are one of the controls to implement it. Logical security architecture will be a reflection of the road map and may serve as the road map after a strategy has been developed. While legal and regulatory requirements must be considered, the road map is based on the strategy, which in turn is based on the enterprise’s objectives. The road map detailing the steps, resources and timelines for development of the strategy is developed after the strategy is determined.

Answer 179

D is the correct answer. Justification Without a clear definition of the issues to be addressed, the probability of success is low. Without a clear definition of the issues to be addressed, the solutions proposed and the results expected, return on investment cannot be calculated. Without a clear definition of the issues to be addressed, the solutions proposed and the results expected, cost-effectiveness cannot be analyzed. Without a clear definition of the issues to be addressed, a business case is not complete and cannot demonstrate the benefits of the new business vision.

Answer 180

A is the correct answer. Justification Information security exists to address risk to the enterprise that may impede achievement of its objectives. Organizational risk will be the most persuasive argument for management commitment and support. Performance metrics will only provide operational information or insight about the information security function but not the business value, which will emphasize a need that forms the basis for senior management support. The information security manager should identify information security needs based on organizational needs; however, security needs alone are not the factor to emphasize to attain senior management commitment. Identifying organizational responsibilities is a task for management and is not related to the objective of attainment of senior management commitment for information security.

Answer 181

B is the correct answer. Justification Direct reports to the chief information officer do not include business process owners, and their input is necessary. Security steering committees provide a forum for management to express its opinion and take some ownership in the decision-making process. It is imperative that business process owners be included in this process. End users and IT professionals would not be part of the steering committee. Internal audit would not be on the steering committee, although legal representation might.

Answer 182

D is the correct answer. Justification Proficiency testing is useful but only with regard to specific technical skills. Job descriptions would not be as useful because they may be out of date or not sufficiently detailed. An organization chart would not provide the details necessary to determine the resources required for this activity. A skills inventory would help identify the available human resources, any gaps, and the training requirements for developing resources.

Answer 183

B is the correct answer. Justification A controls applicability statement identifies which risk controls are applied but is not directly related to performance or maturity assessments. The process performance and capabilities approach provides a more detailed perspective of maturity levels and serves essentially the same purpose. Probabilistic risk assessment provides quantitative results of probability and magnitude of risk; it is not related to assessment of performance or capabilities. Factor analysis of information risk is an approach to assessing risk that does not address performance.

Answer 184

D is the correct answer. Justification Education regarding good information security practices is a part of implementing an effective information security program and is best distributed across the workforce. Senior managers are unlikely to be able to accommodate regular group meetings, and daily operations are better addressed at the level of business process owners. A detailed cost-benefit analysis of the implementation budget is a supporting document that can be referenced to answer questions and establish credibility. However, as a stand-alone document it is not the means by which an information security manager obtains commitment from senior management to implement the information security strategy. A formal presentation to senior management is most appropriate to obtain management commitment when used as a means to educate and communicate key aspects of the overall security program and how security is enabling the achievement of business goals.

Answer 185

A is the correct answer. Justification Feasibility and whether the value proposition makes sense will be major considerations for whether a project will proceed. Resources and time needed are important but will be a component of the value proposition in terms of costs. Financial analysis of benefits is a component of the value proposition, but typically other benefits should be proposed. The value proposition would have to include alignment with the enterprise’s objectives.

Answer 186

D is the correct answer. Justification Risk that will be addressed is a part of what determines feasibility and whether the benefits are sufficient for the cost. Benefits analysis is a part of what determines feasibility and whether the benefits are sufficient for the cost. Alignment with organizational objectives is a part of what determines feasibility and whether the benefits are sufficient for the cost. The feasibility and value proposition are the primary factors in determining whether a project will proceed.

Answer 187

C is the correct answer. Justification A risk assessment is a process used to identify and evaluate risk and its potential effects. This may be part of a business case but alone is less likely to persuade management. An enterprise-wide impact assessment would review the possible consequences of a risk. This may be part of a business case but alone is less likely to persuade management. A business case demonstrating the need and the value proposition is most likely to be persuasive to management. All the other options could be part of a well-developed business case. The net present value would be calculated by using an after-tax discount rate of an investment and a series of expected incremental cash outflows (the initial investment and operational costs) and cash inflows (cost savings or revenues) that occur at regular periods during the life cycle of the investment. This may be part of a business case but alone is less likely to persuade management.

Answer 188

D is the correct answer. Justification Senior management may not be as interested in examples of successful attacks if they are not tied to the impact on business environment and objectives. Senior management will not be as interested in technical risk to the enterprise if it is not tied to the impact on business environment and objectives. Industry good practices may be important to senior management to the extent they are relevant to the enterprise and its business objectives; however, this is not the best method of gaining commitment and support for information security. Tying security risk to key business objectives is the best option to obtain senior managers' commitment and support as they want to understand the justification for investing in security in relation to achieving key business objectives.

Information Security Governance Flashcards

(212 cards)