Industry Best Practices Flashcards

Under the ASIS Enterprise Security Risk Management (ESRM) approach, who is ultimately responsible for deciding whether to accept a given security risk?

Answer: The asset owner or business leader

ESRM positions security as an advisor while the asset owners make final risk acceptance decisions.

In a layered physical protection system, what is the primary purpose of the 'delay' function?

Answer: To give the response force time to arrive before the adversary completes the attack

Delay measures buy time between detection and adversary success so responders can interrupt the attack.

A company purchases an insurance policy to cover losses from cargo theft. Which risk treatment strategy does this represent?

Answer: Risk transfer

Insurance shifts the financial consequences of a loss to a third party, which is risk transfer.

Positioning office windows so employees can easily see the parking lot best illustrates which CPTED principle?

Answer: Natural surveillance

Natural surveillance places legitimate users where they can observe activity, increasing the perceived risk to offenders.

Under the U.S. Fair Credit Reporting Act, what must an employer do before taking adverse action based on a consumer background report?

Answer: Provide the applicant a copy of the report and a summary of rights

The FCRA requires a pre-adverse action notice that includes a copy of the report and the summary of consumer rights.

In business continuity planning, what does the Recovery Time Objective (RTO) define?

Answer: The maximum acceptable time to restore a business function after a disruption

RTO is the target duration within which a process must be restored to avoid unacceptable consequences.

Which of the following is best described as a leading security metric?

Answer: Percentage of employees who completed security awareness training

Leading indicators measure activities that predict future performance, unlike lagging indicators that count past incidents.