Examkin

Question

Difficulty: Very hardSecurity Governance Structures and Policy Frameworks

A financial institution is expanding its open-banking API integration platform. The Chief Risk Officer directs the security architecture team to publish an enterprise-wide governance document establishing mandatory, technology-neutral technical rules—such as requiring TLS 1.3 for all external communication endpoints and mandating a 15-minute maximum session idle timeout—that all development teams must satisfy. The document must enforce strict compliance across all business units without specifying platform-dependent implementation steps or command-line syntax. Which type of governance document should the security architecture team publish to fulfill this directive?

  1. Security StandardAnswer
  2. B
    Security Guideline
  3. C
    Security Baseline
  4. D
    Security Procedure

Answer

Security Standard
The option specifying a Security Standard is correct because standards set mandatory, enterprise-wide technical requirements and operational thresholds that are technology-neutral, ensuring consistent security posture across all development teams.

Step-by-Step Solution

1
Analyze the core requirements of the executive directive.
The directive requires mandatory compliance, technology-neutral technical requirements, and applicability across all business units.
Governance documents are categorized based on their level of compulsion (mandatory vs discretionary) and technical scope (high-level policy, operational standard, platform baseline, or procedural steps).
2
Compare the document characteristics against governance hierarchy definitions.
A Security Standard provides mandatory, platform-independent technical rules and thresholds (such as mandating TLS 1.3 and session timeouts) to ensure uniform compliance.
Unlike baselines (which target specific platforms) or guidelines (which are optional), standards mandate specific technical criteria without prescribing step-by-step procedures.

Key Concept

Security Governance Hierarchy: Policies vs Standards vs Baselines vs Guidelines vs Procedures
Rate this question

Topics

Security Governance Structures and Policy Frameworks

More questions from this topic