CSL Security Policy Development & Compliance 2

Question 1

A CISO discovers that a third-party vendor has access to sensitive data but is not covered by the organization's security policy. What is the BEST immediate step?

Accepted Answer

Issue a temporary security exception while drafting a vendor policy addendum

Answer

A temporary exception with formal documentation preserves operations while the appropriate policy framework is developed for third-party relationships.

Question 2

Which policy governance approach requires that all security policy exceptions be approved by the CISO and documented with a defined expiration date?

Accepted Answer

Policy waiver management

Answer

Policy waiver management formalizes the exception process by requiring senior approval and time-bounding each deviation from standard policy.

Question 3

An organization subject to PCI DSS needs to demonstrate that its security policy is reviewed regularly. What is the minimum required review frequency per PCI DSS?

Accepted Answer

Annually

Answer

PCI DSS Requirement 12.1 mandates that the information security policy be reviewed at least once per year and updated when the environment changes.

Question 4

When drafting an Acceptable Use Policy (AUP), which element is MOST critical to include to ensure enforceability?

Accepted Answer

A clear statement of consequences for violations

Answer

Without defined consequences, an AUP lacks the deterrent and enforcement mechanism needed for legal and disciplinary action.

Question 5

A security leader wants to align the organization's policy framework with NIST SP 800-53. Which control family directly governs policy and procedure documentation?

Accepted Answer

Program Management (PM)

Answer

The Program Management (PM) control family in NIST SP 800-53 addresses organization-wide information security program planning, including policy development and documentation.

(CSL) Cybersecurity Leadership Certification Practice Test

(CSL) Cybersecurity Leadership Certification Practice Test

CSL Security Policy Development & Compliance 2