Policy Development Flashcards

An organization's information security policy requires annual review, but a major acquisition closes mid-cycle, adding a subsidiary that processes regulated health data under a different legal regime. The policy owner proposes waiting for the scheduled review to avoid churn. What is the BEST governance-aligned response?

Answer: Trigger an out-of-cycle policy review driven by the material change, assessing applicability, conflicts, and needed supplemental standards before integrating the subsidiary's data

Policy lifecycle management treats material changes (mergers, new regulatory obligations, new data types) as triggers for out-of-cycle review. Waiting leaves a known compliance gap; imposing the parent policy unchanged ignores legal requirements specific to the health data; and indefinite divergence undermines enterprise governance consistency.

During policy development, a draft password policy contains the statement: 'Passwords must be at least 14 characters, rotated every 60 days, and stored using salted bcrypt with a work factor of 12.' Which critique BEST reflects sound policy-hierarchy practice?

Answer: Technical parameters such as length, rotation, and hashing algorithm belong in standards and procedures, so the policy should state the management intent and reference those documents

Policies express high-level management intent and are relatively stable. Specific mandatory parameters belong in standards, and implementation steps in procedures/guidelines. Embedding volatile technical values in policy forces frequent executive-level re-approval and creates compliance exposure when technology changes.

A business unit requests an exception to the encryption-at-rest policy for a legacy system that cannot support encryption until a planned replacement in 14 months. Which exception-handling approach is MOST consistent with a mature policy framework?

Answer: Approve a time-bound exception with documented risk acceptance by an authorized owner, compensating controls, and a defined expiry and re-evaluation point

A formal exception process requires risk analysis, approval by an appropriate authority (not just the requester), compensating controls, and a defined expiration. Permanent or self-approved exceptions erode policy authority, while blanket denials ignore risk-based decision making.

A newly drafted acceptable use policy has passed legal review and executive approval. Before declaring it operationally effective, which step is MOST often overlooked yet essential to demonstrating policy effectiveness to auditors?

Answer: Obtaining documented workforce communication and acknowledgment, with training aligned to the policy, and establishing metrics to measure compliance

A policy that has not been communicated and acknowledged is difficult to enforce and weak as audit evidence. Governance requires dissemination, awareness, acknowledgment records, and measurable compliance indicators to show the policy is operating, not merely approved.

While developing a data retention policy, the team finds that one regulation requires retaining certain records for 7 years, while a privacy law applicable to the same data requires deletion once the purpose is fulfilled. What is the MOST defensible policy development approach?

Answer: Perform a documented legal analysis of the conflict, define retention by data category with the legal basis for each, and restrict use of retained data to the mandated purpose

Conflicting obligations require legal analysis and a category-based retention schedule that records the legal basis, with retained data limited to the mandated purpose and minimized access. Blanket approaches either breach a mandate or over-retain, and undefined periods lack consistency and auditability.

A policy steering committee is deciding who should hold ultimate accountability for approving the enterprise information security policy. Which assignment BEST aligns with governance principles?

Answer: Senior management or the governing body, with the CISO/policy owner responsible for drafting, maintaining, and reporting on it

Governance principles place approval and accountability with senior management or the board so the policy carries authority and reflects organizational risk appetite. Subject-matter experts draft and maintain it, administrators implement it, and auditors must remain independent and should not approve what they will assess.