Examkin

Soru

Zorluk: OrtaSecurity Governance Structures and Policy Frameworks

Following an enterprise-wide risk assessment, a multi-national cargo shipping organization dictates that all database servers housing customer payment data must enforce mandatory AES-256 encryption at rest across all operating environments. Which governance document type should the security governance team publish to officially enforce this specific mandatory technical requirement?

  1. Security standardCevap
  2. B
    Security guideline
  3. C
    Compensating control
  4. D
    Authorization policy

Cevap

Security standard
A security standard establishes compulsory technical requirements, hardware/software specifications, and uniform operational rules to ensure compliance with overarching organizational security policies.

Adım Adım Çözüm

1
Analyze the scenario requirement
The requirement calls for a mandatory, specific technical rule enforcing AES-256 encryption at rest on database servers.
Governance documents are categorized based on whether they are high-level directives, technical requirements, specific configurations, or discretionary recommendations.
2
Map requirement characteristics to the governance document hierarchy
Technical specifications that are mandatory across systems represent security standards.
High-level intentions are defined in policies, mandatory technical specifications are defined in standards, baseline minimum configurations are baselines, and optional recommendations are guidelines.

Anahtar Kavram

Distinction between mandatory security standards, discretionary guidelines, and high-level governance policies.
Bu soruyu puanla

Konular

Security Governance Structures and Policy Frameworks

Bu konudan daha fazla soru