Questions and Answers
What is the primary factor in selecting an information system security policy framework?
The type of organization
Which of the following frameworks is primarily used for public organizations and is related to SOX 404?
COBIT
What is the benefit of using a flexible security policy framework?
It allows organizations to adopt constructs that fit their governance and compliance planning
Which of the following frameworks is related to ITIL?
Signup and view all the answers
What is the primary reason for using a framework like PCI DSS?
Signup and view all the answers
What is a key consideration when choosing an information system security policy framework?
Signup and view all the answers
Which Act is relevant to the Federal Information Security Management Act (FISMA) framework?
Signup and view all the answers
What is a key characteristic of security policy frameworks?
Signup and view all the answers
Which framework is specifically related to electronic payments?
Signup and view all the answers
What is the primary goal of adopting an information system security policy framework?
Signup and view all the answers
Study Notes
Selecting an Information Systems Security Policy Framework
- Choosing the right framework depends on the organizational type, risk, and top management's view
- A simplified security policy framework domain model can be used
Framework Options
- Federal Information Security Management Act (FISMA) of 2002
- Committee of Sponsoring Organizations (COSO)
- Control Objectives for Information and related Technology (COBIT) (for public organizations, especially for SOX 404)
- ISO 17799 (27002) and 20000 (ITIL)
- NIST
- OCTAVE
- PCI DSS (for organizations that process payments electronically)
Framework Characteristics
- Flexible and adaptable to an organization's governance and compliance planning requirements
- Allows organizations to adopt constructs that fit their needs
Selecting an Information Systems Security Policy Framework
- Choosing the right framework depends on the organizational type, risk, and top management's view
- A simplified security policy framework domain model can be used
Framework Options
- Federal Information Security Management Act (FISMA) of 2002
- Committee of Sponsoring Organizations (COSO)
- Control Objectives for Information and related Technology (COBIT) (for public organizations, especially for SOX 404)
- ISO 17799 (27002) and 20000 (ITIL)
- NIST
- OCTAVE
- PCI DSS (for organizations that process payments electronically)
Framework Characteristics
- Flexible and adaptable to an organization's governance and compliance planning requirements
- Allows organizations to adopt constructs that fit their needs
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
