Examkin

Question

Difficulty: EasySecurity Governance Structures and Policy Frameworks

A Chief Information Security Officer (CISO) is structuring an organization's governance framework. The CISO needs to clearly differentiate between binding organizational rules and discretionary advice. Which of the following governance document types establish MANDATORY requirements that personnel or technical systems must follow? (Select TWO).

  1. Security PoliciesAnswer
  2. Security StandardsAnswer
  3. C
    Security Guidelines
  4. D
    Security Control Categories

Answer

Security Policies and Security Standards establish mandatory compliance requirements within an enterprise governance hierarchy.
In security governance, Security Policies serve as mandatory high-level statements of management intent that direct user conduct and organizational security expectations. Security Standards set specific, mandatory requirements (such as technical requirements or operational constraints) that systems and users must adhere to without exception.

Step-by-Step Solution

1
Identify the compliance obligation of each document type in the governance hierarchy.
Policies and Standards are mandatory directives, whereas Guidelines are discretionary.
Governance frameworks separate mandatory directives (Policies, Standards, Baselines, Procedures) from optional recommendations (Guidelines).
2
Select all option choices that represent binding, mandatory governance documents.
Security Policies and Security Standards are selected.
Security Policies set management intent and mandatory rules across the enterprise, while Security Standards enforce mandatory specific technology choices and baseline requirements.

Key Concept

Distinction between mandatory compliance documents (Policies, Standards) and discretionary governance materials (Guidelines).
Rate this question

Topics

Security Governance Structures and Policy Frameworks

More questions from this topic