Examkin

Question

Difficulty: MediumSecurity Governance Structures and Policy Frameworks

A regional health authority is updating its overarching security governance framework following an infrastructure modernization project. The governance steering committee must clearly distinguish between mandatory governance mandates and non-binding operational material. Which of the following document types constitute mandatory compliance requirements within the enterprise security governance framework? (Select TWO).

  1. Enterprise Security Policies that state management intent and define high-level mandatory requirements.Answer
  2. Technical Security Standards that specify mandatory baseline rules and technology configurations.Answer
  3. C
    Security Guidelines that offer recommended practices and discretionary operational advice.
  4. D
    Compensating Control Requests that document temporary exemptions from default security controls.
  5. E
    Vendor Architecture Whitepapers that describe recommended third-party integration patterns.

Answer

Enterprise Security Policies and Technical Security Standards are both mandatory elements of a security governance framework.
Enterprise Security Policies and Technical Security Standards are mandatory components of security governance. Policies reflect executive leadership direction and establish compulsory high-level rules, while standards define mandatory, measurable technical configurations and operational constraints.

Step-by-Step Solution

1
Identify the mandatory vs. discretionary elements in a standard security governance documentation hierarchy.
Policies (mandatory executive directives) and Standards (mandatory technical rules) are compulsory, whereas Guidelines are discretionary recommendations.
Governance frameworks rely on policies to establish mandatory high-level rules and standards to enforce uniform technical specifications.
2
Evaluate each provided document type against compulsory compliance criteria.
Enterprise Security Policies and Technical Security Standards carry mandatory authority, whereas Guidelines, Whitepapers, and Exception Requests do not set compulsory framework rules.
Only policies and standards establish legally and operationally binding security requirements across all organizational units.

Key Concept

Hierarchy of Security Governance Documents (Policies, Standards, Baselines, Guidelines, Procedures)
Estimated Time:1m 30s
Rate this question

Topics

Security Governance Structures and Policy Frameworks

More questions from this topic