Examkin

Question

Difficulty: HardSecurity Governance Structures and Policy Frameworks

Following an enterprise-wide audit, a Chief Information Security Officer (CISO) is restructuring the organizational governance framework to clear up employee confusion between mandatory directives and discretionary recommendations. Which of the following governance document types establish mandatory requirements that enforce compliance across the enterprise? (Select TWO).

  1. Security PoliciesAnswer
  2. Security StandardsAnswer
  3. C
    Security Guidelines
  4. D
    Standard Operating Procedures
  5. E
    Compensating Control Frameworks

Answer

Security Policies and Security Standards are mandatory elements of a governance framework.
In security governance, Security Policies serve as the overarching executive directives that define high-level mandatory rules, objectives, and responsibilities. Security Standards support policies by providing explicit, compulsory specifications, metrics, and technology baselines that all systems and staff must strictly adhere to.

Step-by-Step Solution

1
Analyze governance document categories for mandatory versus discretionary attributes.
Identify that policies (high-level executive directives) and standards (specific operational/technical baselines) are compulsory.
Governance frameworks separate mandatory directives from non-binding guidance to establish enforceable compliance boundaries.
2
Evaluate discretionary options and operational implementation details.
Distinguish guidelines as optional advice and procedures/compensating controls as operational steps or technical remedies.
Guidelines advise rather than enforce, while procedures supply action steps without defining governance authority.

Key Concept

Security Governance Hierarchy (Mandatory Directives vs. Discretionary Guidance)
Rate this question

Topics

Security Governance Structures and Policy Frameworks

More questions from this topic