Examkin

Question

Difficulty: Very hardSecurity Governance Structures and Policy Frameworks

During an enterprise audit of a recently deployed cloud-native microservices architecture, auditors discovered that while executive leadership has mandated data encryption at rest, individual development teams are implementing inconsistent cryptographic algorithms, key lengths, and key rotation schedules. To remediate this finding by establishing mandatory, uniform technical specifications across all microservices without detailing tactical, step-by-step operational workflows, which security governance document must the CISO publish?

  1. Security StandardAnswer
  2. B
    Security Policy
  3. C
    Security Guideline
  4. D
    Security Procedure

Answer

Security Standard
A Security Standard is a mandatory governance document that defines specific, uniform technical criteria, parameters, and technologies (such as mandatory AES-256 encryption, approved cipher suites, and 90-day key rotation requirements) that all systems must meet to align with high-level security policies.

Step-by-Step Solution

1
Analyze the scenario requirement and constraints
The document must be mandatory, enforce explicit technical specifications (algorithms, key lengths, rotation schedules), and avoid step-by-step task execution instructions.
The audit finding stems from inconsistent technical implementation despite an existing high-level policy mandate.
2
Evaluate the governance document hierarchy against the requirements
Policies state high-level goals; Standards establish mandatory mandatory technical rules and configurations; Guidelines offer non-binding advice; Procedures provide step-by-step instructions.
Establishing explicit mandatory baseline settings like key lengths and cipher suites fits the definition of a Standard.
3
Select the governance document matching mandatory technical specifications
A Security Standard directly satisfies the need for mandatory, uniform technical parameters across dev teams without imposing step-by-step procedures.
Standards bridge the gap between high-level policy objectives and low-level operational execution.

Key Concept

Security Governance Document Hierarchy: Security Standards
Rate this question

Topics

Security Governance Structures and Policy Frameworks

More questions from this topic