Examkin

Question

Difficulty: EasySecurity Governance Structures and Policy Frameworks

An enterprise security manager is defining the organization's internal governance framework. Which of the following document types represent mandatory rules or directives within an enterprise security governance structure? (Select TWO).

  1. High-level security policies established by executive managementAnswer
  2. Technical security standards that specify compulsory requirementsAnswer
  3. C
    Discretionary security guidelines that provide flexible recommendations
  4. D
    External vendor security whitepapers offering general technical advice
  5. E
    Informational security awareness posters distributed to office staff

Answer

High-level security policies established by executive management and technical security standards that specify compulsory requirements.
Within an enterprise security governance framework, high-level security policies set by leadership and technical security standards are compulsory and mandatory for all organizational members and systems to follow.

Step-by-Step Solution

1
Identify the binding, compulsory document types within a security governance hierarchy.
Policies and standards are formal, mandatory directives that employees and systems must comply with.
Executive policies outline overarching requirements, while standards provide specific mandatory implementation rules.
2
Distinguish binding governance documents from non-binding advisory or promotional materials.
Guidelines, vendor whitepapers, and awareness posters are non-mandatory and discretionary.
Non-binding documents provide recommendations or context but do not enforce organizational compliance.

Key Concept

Security Governance Hierarchy (Mandatory Policies and Standards vs. Discretionary Guidelines)
Estimated Time:45s
Rate this question

Topics

Security Governance Structures and Policy Frameworks

More questions from this topic