Examkin

Question

Difficulty: HardSecurity Governance Structures and Policy Frameworks

An enterprise organization is updating its security governance framework following a comprehensive compliance audit. The Governance, Risk, and Compliance (GRC) team must establish clear operational boundaries between mandatory requirements and discretionary guidance across all departments. Which of the following governance components represent MANDATORY requirements that personnel or technical implementations must strictly adhere to? (Select TWO.)

  1. An Acceptable Use Policy (AUP) establishing high-level mandatory behavioral expectations and administrative rules across the enterprise.Answer
  2. A Technical Security Standard specifying compulsory baseline configurations, such as requiring AES-256 encryption for data at rest.Answer
  3. C
    A Security Guideline offering recommended best practices and advisory suggestions for securing personal home office networks.
  4. D
    A Security Advisory document outlining discretionary recommendations for software developers during code review sessions.
  5. E
    An Identity Authentication Framework defining single sign-on user verification steps before assigning role permissions.

Answer

The Acceptable Use Policy (AUP) and the Technical Security Standard represent mandatory governance requirements.
In enterprise security governance, Policies and Standards are mandatory elements. An Acceptable Use Policy establishes top-level compulsory rules set by executive leadership, while a Technical Security Standard mandates explicit technical controls (such as mandatory encryption algorithms) that systems must implement without exception unless a formal variance is granted.

Step-by-Step Solution

1
Analyze enforceability levels in security governance documentation hierarchies.
Policies (such as an AUP) and Standards (such as encryption requirements) are mandatory enforcement tools.
Policies reflect executive management mandates, while standards mandate specific, non-negotiable technical or operational configurations.
2
Evaluate non-binding governance documentation types.
Guidelines and advisories represent discretionary guidance.
Guidelines provide best-practice recommendations that allow operational flexibility and lack mandatory compliance enforceability.
3
Distinguish documentation hierarchy tiers from technical operational controls.
Identity authentication frameworks define technical access control functions rather than governance document enforceability tiers.
AAA technical mechanisms execute access decisions but do not define organizational governance documentation rules.

Key Concept

Security Governance Hierarchy (Mandatory Policies & Standards vs. Discretionary Guidelines)
Rate this question

Topics

Security Governance Structures and Policy Frameworks

More questions from this topic