Examkin

Question

Difficulty: MediumSecurity Governance Structures and Policy Frameworks

An enterprise healthcare provider establishes an executive directive mandating that all sensitive patient data must be encrypted both in transit and at rest across all internal systems. To operationalize this executive mandate, the IT security team creates a mandatory compliance document that details the specific required cryptographic algorithms, minimum key lengths, and approved cipher suites that system administrators must configure on all database nodes without exception. Which component of the security governance hierarchy does this technical configuration document represent?

  1. Security StandardAnswer
  2. B
    Security Guideline
  3. C
    Security Policy
  4. D
    Compensating Control

Answer

The cryptographic configuration document represents a Security Standard because it provides mandatory, specific technical requirements designed to support high-level policy objectives.
The correct option is Security Standard. Security standards are compulsory governance documents that define specific technical requirements, hardware/software configurations, or operational rules (such as approved cipher suites and key lengths) necessary to support high-level policies.

Step-by-Step Solution

1
Analyze the document's authority level and degree of compliance required.
The document specifies mandatory technical settings (key lengths and cipher suites) that administrators must implement without exception.
Governance elements are categorized based on whether they are high-level directives (policies), mandatory technical specifications (standards), minimum platform benchmarks (baselines), or discretionary recommendations (guidelines).
2
Differentiate between policy objectives and implementation standards.
The executive directive mandating data encryption represents the policy, whereas the detailed document defining specific cryptographic algorithms and key lengths represents the supporting standard.
Policies state what must be done, whereas standards define the exact mandatory rules and technical criteria required to achieve that goal.

Key Concept

Security Policy and Standard Hierarchy
Estimated Time:1m 30s
Rate this question

Topics

Security Governance Structures and Policy Frameworks

More questions from this topic