CCISO Security Program Development & Management 4

Question 1

A newly appointed CISO finds the security program is reactive with no formal strategy. What should be the FIRST priority?

Accepted Answer

Conduct a comprehensive risk assessment to establish a baseline

Answer

A risk assessment establishes the current state and priorities, forming the foundation for any strategic security program development.

Question 2

Which document BEST communicates the organization's commitment to information security to both internal and external stakeholders?

Accepted Answer

Information Security Policy

Answer

An Information Security Policy is the high-level governance document that formally declares the organization's commitment and sets the tone from leadership.

Question 3

An organization is expanding globally and must manage security across multiple regulatory jurisdictions. What is the MOST effective approach?

Accepted Answer

Develop a baseline security framework and layer jurisdiction-specific controls on top

Answer

A baseline with layered jurisdiction-specific controls efficiently meets multiple regulatory requirements without duplicating the entire security program.

Question 4

Which role in an information security governance structure is PRIMARILY responsible for accepting residual risk?

Accepted Answer

Business Process Owner / Senior Management

Answer

Risk acceptance is a business decision made by business process owners or senior management who understand the risk appetite and business impact.

Question 5

A CISO wants to ensure security requirements are captured for a new cloud migration project from the start. Which practice BEST achieves this?

Accepted Answer

Participating in project initiation and including security in the business case

Answer

Integrating security at project initiation ensures requirements are built in by design rather than retrofitted, reducing cost and risk.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Security Program Development & Management 4