Information Security Governance Flashcards

Which of the following BEST illustrates an effective security governance reporting structure?

Answer: CISO reports to both the CEO and board with regular updates

Effective governance requires the CISO to report to senior leadership and the board regularly, ensuring visibility and accountability at the highest levels.

An organization wants to ensure its security governance program remains effective over time. The BEST mechanism is:

Answer: Continuous monitoring and periodic program reviews

Continuous monitoring and periodic reviews ensure the governance program adapts to changing threats, business needs, and regulatory requirements.

Which of the following represents a governance control rather than a technical control?

Answer: Acceptable use policy

An acceptable use policy is a governance (administrative) control that defines rules and expectations for users, rather than a technical enforcement mechanism.

A newly appointed CISM discovers the organization has no formal security governance structure. The FIRST step should be to:

Answer: Obtain executive sponsorship and establish governance authority

Without executive sponsorship and formal governance authority, a CISM cannot effectively implement or enforce any security program.

Which of the following BEST defines 'security culture' within a governance context?

Answer: The shared values, behaviors, and attitudes toward security among employees

Security culture refers to the collective attitudes, values, and behaviors of employees toward security, which governance programs aim to develop and reinforce.

When assigning ownership of information assets, the MOST appropriate owner is typically:

Answer: The business unit manager responsible for the asset

Business unit managers, as the primary users and beneficiaries of information assets, are the most appropriate owners with accountability for their protection.