Policy Development Flashcards

An organization's information security policy mandates annual review, but a newly enacted privacy regulation takes effect in four months and conflicts with a clause on data retention. The policy owner proposes waiting for the scheduled review cycle in 10 months. What is the MOST appropriate policy development action?

Answer: Initiate an out-of-cycle policy revision through the established change process, with stakeholder review and approval before the regulation's effective date

Material changes to the legal or regulatory environment are triggers for event-driven (out-of-cycle) policy review. The revision must still go through the formal change and approval process, and be completed before the effective date to avoid noncompliance. Waiting creates a compliance gap, blanket exceptions undermine the policy, and a standard cannot contradict its parent policy or be changed without approval.

During policy development, a business unit in a jurisdiction with stricter data localization law requests a policy variation from the enterprise-wide policy. Which approach BEST preserves policy hierarchy integrity?

Answer: Develop a documented regional addendum or standard that meets or exceeds the enterprise policy's requirements, approved through the same governance authority

Local requirements are best handled through a controlled supplement (addendum or jurisdiction-specific standard) that stays consistent with, and at least as stringent as, the enterprise policy and is approved by the governing body. Superseding policies fragment governance, permanent exemptions erode control, and ignoring law is noncompliant.

A draft policy contains the statement: 'Systems should generally be patched in a timely manner where practical.' Which deficiency is MOST significant from a policy development and auditability perspective?

Answer: The language is vague and non-mandatory, so compliance cannot be objectively measured or enforced

Words such as 'should generally', 'timely', and 'where practical' create ambiguity and discretionary compliance, making the requirement unauditable and unenforceable. Policies should use clear mandatory language ('must') and defer specific timeframes to standards. The statement is actually lacking technical detail rather than containing too much, and naming vendor tools is not a policy-level concern.

A policy has been approved by the governing committee, but a review of the rollout plan shows that no mechanism exists to confirm that affected personnel have read and understood it. Which control gap is MOST critical to remedy before the policy is considered effectively implemented?

Answer: Absence of a documented communication and acknowledgment process tied to training and attestation records

A policy is effective only if it is communicated and understood. Documented communication, training, and recorded acknowledgment provide evidence of awareness and support enforcement and audit. Design templates, archival of drafts, and universal translation are secondary to demonstrable awareness among those bound by the policy.

An organization is developing a policy for a system categorized under a federal risk framework, and the policy must trace to control requirements. Which method BEST ensures the policy supports both compliance and risk-based tailoring without duplicating content?

Answer: Write a high-level policy stating management intent and map it to control baselines, with tailoring and scoping decisions documented in standards and system-level documentation

Effective policy architecture keeps policy at the intent level and maps it to control families/baselines, with tailoring, scoping, and parameter values documented in standards and system security plans. This avoids duplication, supports traceability, and allows risk-based adaptation. Copying controls creates bloated, hard-to-maintain policy; omitting policy removes management authority; per-system policies produce inconsistency.

A policy exception request is submitted for a legacy system that cannot meet a mandatory encryption requirement. Which exception management practice BEST aligns with sound policy governance?

Answer: Document the risk, require compensating controls, obtain approval from an authority at the appropriate risk level, set an expiration date, and track it for periodic reassessment

A sound exception process documents the business justification and residual risk, requires compensating controls, and obtains approval from someone with authority to accept that level of risk, not just the system owner. Exceptions should be time-bound and tracked so they are reviewed and either remediated or formally renewed. Indefinite or owner-only approval defeats governance, and blanket denial ignores risk-based decision making.