Examkin

Soru

Zorluk: Çok zorSecurity Governance Structures and Policy Frameworks

A financial institution is expanding its open-banking API integration platform. The Chief Risk Officer directs the security architecture team to publish an enterprise-wide governance document establishing mandatory, technology-neutral technical rules—such as requiring TLS 1.3 for all external communication endpoints and mandating a 15-minute maximum session idle timeout—that all development teams must satisfy. The document must enforce strict compliance across all business units without specifying platform-dependent implementation steps or command-line syntax. Which type of governance document should the security architecture team publish to fulfill this directive?

  1. Security StandardCevap
  2. B
    Security Guideline
  3. C
    Security Baseline
  4. D
    Security Procedure

Cevap

Security Standard
The option specifying a Security Standard is correct because standards set mandatory, enterprise-wide technical requirements and operational thresholds that are technology-neutral, ensuring consistent security posture across all development teams.

Adım Adım Çözüm

1
Analyze the core requirements of the executive directive.
The directive requires mandatory compliance, technology-neutral technical requirements, and applicability across all business units.
Governance documents are categorized based on their level of compulsion (mandatory vs discretionary) and technical scope (high-level policy, operational standard, platform baseline, or procedural steps).
2
Compare the document characteristics against governance hierarchy definitions.
A Security Standard provides mandatory, platform-independent technical rules and thresholds (such as mandating TLS 1.3 and session timeouts) to ensure uniform compliance.
Unlike baselines (which target specific platforms) or guidelines (which are optional), standards mandate specific technical criteria without prescribing step-by-step procedures.

Anahtar Kavram

Security Governance Hierarchy: Policies vs Standards vs Baselines vs Guidelines vs Procedures
Bu soruyu puanla

Konular

Security Governance Structures and Policy Frameworks

Bu konudan daha fazla soru