Information Security Governance Flashcards

Which framework is MOST commonly used to establish information security governance in US enterprises?

Answer: COBIT

COBIT (Control Objectives for Information and Related Technologies) is widely used for IT and information security governance in enterprises.

When developing a security governance program, a CISM should FIRST:

Answer: Understand the organization's business strategy and objectives

Understanding the business strategy ensures that the security governance program is aligned with and supports organizational goals from the outset.

Which of the following BEST describes the relationship between IT governance and information security governance?

Answer: Information security governance is a subset of IT governance

Information security governance is a subset of IT governance, which itself is a component of overall corporate governance.

A CISM is presenting a security governance roadmap to the CEO. The presentation should PRIMARILY focus on:

Answer: Security risk in terms of business impact and strategic alignment

Executive presentations should frame security governance in business terms, focusing on risk, impact, and alignment with organizational strategy.

Which of the following is a KEY output of a mature information security governance program?

Answer: Security metrics aligned to business objectives

A mature governance program produces meaningful security metrics that are tied to and measured against business objectives, demonstrating value to leadership.

Separation of duties in security governance is PRIMARILY intended to:

Answer: Reduce the risk of fraud and error by distributing responsibilities

Separation of duties distributes critical responsibilities so that no single person can complete a high-risk task alone, reducing the risk of fraud or error.