Governance Principles Flashcards

A multinational organization's board has delegated cybersecurity risk oversight to a risk committee. The committee's charter assigns it authority to accept residual risk up to a defined threshold. During an authorization review, the Authorizing Official (AO) proposes accepting a residual risk that exceeds the threshold but is below the enterprise-wide risk tolerance set by the board. Which governance principle MOST directly determines whether the AO can proceed?

Answer: Risk acceptance authority must follow the delegation of authority, so the AO must escalate to the level that holds acceptance authority for that magnitude of risk

Risk tolerance is the boundary the board sets, but individual risk acceptance authority is exercised only within formally delegated limits. A risk above the delegated threshold must be escalated to the level that holds that authority, even if it falls within overall tolerance. Concurrence, POA&Ms, and register entries do not substitute for delegated authority.

An organization is subject to both a regulatory requirement and an internal policy that cover the same control area. The internal policy is stricter in some respects and silent in others, and the two conflict on one retention period (the policy is shorter than the regulation requires). What is the MOST appropriate governance response?

Answer: Apply the regulatory requirement for the conflicting retention period, retain the stricter internal provisions elsewhere, and revise the policy to remove the conflict

Laws and regulations take precedence over internal policy. Where the policy is stricter, it remains in force. Where it conflicts with a mandatory requirement, compliance with the requirement is non-negotiable and the policy must be corrected through the governance document lifecycle. Risk appetite and risk acceptance cannot override legal obligations.

A governance review finds that a security policy is approved and published, but several operating units have never produced the supporting standards or procedures that implement it. Auditors note that controls are nonetheless performed informally. Which finding BEST characterizes the governance deficiency?

Answer: A policy hierarchy gap, because policy intent is not translated into enforceable standards and repeatable procedures, which prevents consistent implementation and auditability

Governance depends on a cascade from policy (intent) to standards (mandatory requirements) to procedures (steps). Without the lower tiers, controls are performed inconsistently and cannot be evidenced or audited, even if some activity occurs informally.

A federal agency's CISO reports to the CIO. The agency head is concerned that this arrangement creates a conflict of interest when security requirements compete with IT delivery schedules. Which governance approach BEST addresses the concern while preserving accountability?

Answer: Retain the reporting line but give the CISO independent access to the agency head and the risk executive function, and document escalation rights for unresolved disagreements

Governance models commonly manage the tension between delivery and security through independent escalation paths and formal risk executive oversight, without removing accountability. Making the CISO subordinate to IT budget control increases the conflict. Distributing duties dilutes accountability, and reporting to internal audit compromises audit independence.

An organization uses a third-party cloud provider and relies on the provider's attestation report to satisfy several control requirements. During governance review, which statement reflects a correct understanding of accountability?

Answer: The organization retains accountability for risk to its own information and must verify that the provider's attested scope, complementary user entity controls, and exceptions align with its needs

Responsibility for performing certain controls can be delegated, but accountability for risk to the organization's information remains with the organization. It must confirm the report's scope, complementary user entity controls, and noted exceptions actually cover its use case.

An organization's policy review cycle is annual, but a major regulation changes mid-cycle and a significant merger closes in the same quarter. Which approach is MOST consistent with sound governance principles?

Answer: Trigger an event-driven review of affected policies, with documented approval, communication, and a change history, independent of the scheduled cycle

Effective governance combines periodic reviews with event-driven reviews triggered by significant changes in regulation, business structure, or risk. The review should follow the approval, communication, and versioning process to maintain control and traceability.