Examkin

Soru

Zorluk: KolaySecurity Governance Structures and Policy Frameworks

A Chief Information Security Officer (CISO) is structuring an organization's governance framework. The CISO needs to clearly differentiate between binding organizational rules and discretionary advice. Which of the following governance document types establish MANDATORY requirements that personnel or technical systems must follow? (Select TWO).

  1. Security PoliciesCevap
  2. Security StandardsCevap
  3. C
    Security Guidelines
  4. D
    Security Control Categories

Cevap

Security Policies and Security Standards establish mandatory compliance requirements within an enterprise governance hierarchy.
In security governance, Security Policies serve as mandatory high-level statements of management intent that direct user conduct and organizational security expectations. Security Standards set specific, mandatory requirements (such as technical requirements or operational constraints) that systems and users must adhere to without exception.

Adım Adım Çözüm

1
Identify the compliance obligation of each document type in the governance hierarchy.
Policies and Standards are mandatory directives, whereas Guidelines are discretionary.
Governance frameworks separate mandatory directives (Policies, Standards, Baselines, Procedures) from optional recommendations (Guidelines).
2
Select all option choices that represent binding, mandatory governance documents.
Security Policies and Security Standards are selected.
Security Policies set management intent and mandatory rules across the enterprise, while Security Standards enforce mandatory specific technology choices and baseline requirements.

Anahtar Kavram

Distinction between mandatory compliance documents (Policies, Standards) and discretionary governance materials (Guidelines).
Bu soruyu puanla

Konular

Security Governance Structures and Policy Frameworks

Bu konudan daha fazla soru