Examkin

Question

Difficulty: HardSecurity Governance Structures and Policy Frameworks

During a multi-cloud infrastructure compliance review, a cloud engineering team is evaluating security controls against corporate documentation. Executive leadership previously published an overarching document mandating that all workloads in production environments must encrypt data in transit. To operationalize this directive, the security engineering department issued a compulsory document specifying that all inter-service cluster communications must strictly utilize TLS 1.3 with specific approved cipher suites and mandatory mutual authentication parameters. Which of the following governance framework document types is represented by this mandatory technical specification?

  1. A
    Security Policy
  2. Security StandardAnswer
  3. C
    Security Guideline
  4. D
    Security Baseline

Answer

The mandatory technical specification document is a Security Standard.
A Security Standard defines compulsory rules, technologies, parameters, and measurable metrics needed to achieve policy objectives. Specifying TLS 1.3, exact cipher suites, and mutual authentication parameters constitutes a mandatory technical standard.

Step-by-Step Solution

1
Analyze the governance document characteristics described in the scenario.
The document specifies exact mandatory technical parameters (TLS 1.3, specific cipher suites, mutual authentication) that enforce an executive directive.
Governance documents are categorized based on their level of technical detail and whether compliance is mandatory or discretionary.
2
Differentiate between policies, standards, guidelines, and baselines.
Policies establish top-level mandates; standards define mandatory technical rules/configurations; guidelines offer optional advice; baselines establish minimum configuration snapshots for systems.
Matching technical requirements to governance hierarchy definitions ensures correct classification.
3
Select the governance document type that matches mandatory specific technical configurations.
Security Standard is the precise match.
Standards bridges high-level policy intent with actionable, mandatory technical enforcement rules across an organization.

Key Concept

Hierarchy of Security Governance Documents (Policies vs. Standards vs. Baselines vs. Guidelines)
Rate this question

Topics

Security Governance Structures and Policy Frameworks

More questions from this topic