CSPM Security Governance & Leadership Flashcards

A CSPM professional conducting a security program gap analysis compares the current state against:

Answer: A desired target state or recognized security standard

A gap analysis measures the difference between an organization's current security posture and a target framework or maturity level to identify areas requiring improvement.

Which leadership model focuses on inspiring teams through vision, motivation, and transformational change — particularly relevant in driving security culture shifts?

Answer: Transformational leadership

Transformational leaders motivate teams by articulating a compelling vision and inspiring change, making this style especially effective for embedding security culture across an organization.

In a security project, a RACI matrix is used to clarify:

Answer: Roles and responsibilities for project tasks and decisions

A RACI matrix defines who is Responsible, Accountable, Consulted, and Informed for each project activity, preventing confusion and gaps in ownership.

What is the key difference between a security policy and a security standard?

Answer: Policies state high-level intent and requirements; standards specify mandatory controls to meet those requirements

Security policies establish the 'what and why' at a high level, while standards define the specific, mandatory 'how' — the measurable requirements that satisfy the policy.

Which stakeholder communication approach is most effective when presenting security risk findings to a non-technical executive board?

Answer: Business-impact-focused summaries tied to financial and operational risk

Executives make decisions based on business impact and financial risk, so security findings must be translated into organizational risk language — not raw technical detail.

In security governance, 'due care' refers to:

Answer: Taking reasonable and prudent steps to protect assets and meet one's legal obligations

Due care means an organization has taken the steps a reasonable and prudent person would take to protect assets, demonstrating legal and ethical responsibility for security.