Podcast
Questions and Answers
What should security policies never contradict?
What should security policies never contradict?
- Security controls
- Technological standards
- Organizational laws (correct)
- Management instructions
What is the role of policies in information security?
What is the role of policies in information security?
- Serve as the basis for all information security efforts (correct)
- Are the most expensive controls to execute
- Direct how technologies should be used
- Explain how to comply with standards
Which term refers to more detailed statements of what must be done to comply with policy?
Which term refers to more detailed statements of what must be done to comply with policy?
- Guidelines
- Procedures
- Standards (correct)
- Practices
Why are security policies considered the least expensive controls to execute?
Why are security policies considered the least expensive controls to execute?
What is necessary for a policy to be effective, according to the text?
What is necessary for a policy to be effective, according to the text?
Which term is used alternatively to refer to an Enterprise Information Security Policy (EISP)?
Which term is used alternatively to refer to an Enterprise Information Security Policy (EISP)?
What is a key role of management in information security?
What is a key role of management in information security?
What is the purpose of an information security blueprint?
What is the purpose of an information security blueprint?
How can an organization institutionalize its information security policies?
How can an organization institutionalize its information security policies?
What is the relationship between contingency planning and incident response planning?
What is the relationship between contingency planning and incident response planning?
How does strategic planning contribute to information security?
How does strategic planning contribute to information security?
Why is the development of an information security blueprint essential for organizations?
Why is the development of an information security blueprint essential for organizations?
What distinguishes an incident from a disaster?
What distinguishes an incident from a disaster?
What is a key responsibility of the crisis management team during a disaster?
What is a key responsibility of the crisis management team during a disaster?
What is an essential step in the contingency planning process?
What is an essential step in the contingency planning process?
What is the purpose of off-site disaster data storage?
What is the purpose of off-site disaster data storage?
Who is responsible for determining the impact on normal business operations during a crisis?
Who is responsible for determining the impact on normal business operations during a crisis?
When should law enforcement be involved according to the text?
When should law enforcement be involved according to the text?
What is one advantage of involving law enforcement agencies in a case?
What is one advantage of involving law enforcement agencies in a case?
What is a disadvantage of involving law enforcement agencies in a case?
What is a disadvantage of involving law enforcement agencies in a case?
Why is information security education, training, and awareness (SETA) important?
Why is information security education, training, and awareness (SETA) important?
What does contingency planning (CP) consist of?
What does contingency planning (CP) consist of?
If an organization detects a criminal act, what is it legally obligated to do?
If an organization detects a criminal act, what is it legally obligated to do?
What is the role of management in information security?
What is the role of management in information security?
What is the primary purpose of an Executive Information Security Policy (EISP)?
What is the primary purpose of an Executive Information Security Policy (EISP)?
Which of the following is NOT typically included in an EISP?
Which of the following is NOT typically included in an EISP?
What is the main focus of Issue-Specific Security Policies (ISSPs)?
What is the main focus of Issue-Specific Security Policies (ISSPs)?
Which of the following is NOT a component of Issue-Specific Security Policies (ISSPs)?
Which of the following is NOT a component of Issue-Specific Security Policies (ISSPs)?
What role does a policy administrator play in maintaining effective security policies?
What role does a policy administrator play in maintaining effective security policies?
What does the Information Security Blueprint serve as a detailed plan for?
What does the Information Security Blueprint serve as a detailed plan for?
What does ISO 27000 Series provide in the context of information security?
What does ISO 27000 Series provide in the context of information security?
What is the main focus of NIST Security Models?
What is the main focus of NIST Security Models?
What key aspects are involved in the design of Security Architecture?
What key aspects are involved in the design of Security Architecture?
What is the aim of a Security Education, Training, and Awareness Program?
What is the aim of a Security Education, Training, and Awareness Program?
Flashcards are hidden until you start studying
