Examkin

Question

Difficulty: MediumSecurity Governance Structures and Policy Frameworks

Following an enterprise-wide risk assessment, a multi-national cargo shipping organization dictates that all database servers housing customer payment data must enforce mandatory AES-256 encryption at rest across all operating environments. Which governance document type should the security governance team publish to officially enforce this specific mandatory technical requirement?

  1. Security standardAnswer
  2. B
    Security guideline
  3. C
    Compensating control
  4. D
    Authorization policy

Answer

Security standard
A security standard establishes compulsory technical requirements, hardware/software specifications, and uniform operational rules to ensure compliance with overarching organizational security policies.

Step-by-Step Solution

1
Analyze the scenario requirement
The requirement calls for a mandatory, specific technical rule enforcing AES-256 encryption at rest on database servers.
Governance documents are categorized based on whether they are high-level directives, technical requirements, specific configurations, or discretionary recommendations.
2
Map requirement characteristics to the governance document hierarchy
Technical specifications that are mandatory across systems represent security standards.
High-level intentions are defined in policies, mandatory technical specifications are defined in standards, baseline minimum configurations are baselines, and optional recommendations are guidelines.

Key Concept

Distinction between mandatory security standards, discretionary guidelines, and high-level governance policies.
Rate this question

Topics

Security Governance Structures and Policy Frameworks

More questions from this topic