Core Concepts and Principles Flashcards

The management principle that each employee should report to only one supervisor is called:

Answer: Unity of command

Unity of command prevents conflicting instructions by giving each subordinate a single supervisor.

'Span of control' refers to:

Answer: The number of subordinates one supervisor can effectively manage

Span of control limits how many people one manager can supervise effectively, depending on task complexity.

Why is it generally recommended that the senior security executive report to a high level of management?

Answer: To ensure independence, visibility, and the authority to influence organizational risk decisions

Reporting high in the organization gives security the access and influence it needs to protect enterprise assets.

From a cost-benefit standpoint, a countermeasure is generally justified when:

Answer: Its cost is lower than the expected reduction in loss

Security spending should be proportional to the loss it is expected to prevent.

If the single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2, what is the annualized loss expectancy (ALE)?

Answer: $10,000

ALE = SLE × ARO, so $50,000 × 0.2 = $10,000.

Restricting sensitive information to people whose duties require it, even if they hold the right clearance, applies which principle?

Answer: Need to know

Need to know limits disclosure to people who need the information for their work, regardless of clearance level.

Requiring that one employee approve vendor payments while another processes them is an example of:

Answer: Separation of duties

Splitting critical tasks among different people means fraud would require collusion.