CSPM Security Governance & Leadership Flashcards

A CSPM professional facilitates a tabletop exercise. The primary goal of this activity is to:

Answer: Simulate a crisis scenario to identify gaps in plans and team readiness without real-world disruption

Tabletop exercises use discussion-based simulations of security incidents to test plans, identify weaknesses in response procedures, and improve team coordination without impacting live systems.

Which security metric is most useful for demonstrating a security program's effectiveness to senior leadership over time?

Answer: Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) trends

MTTD and MTTR are outcome-based metrics that directly reflect the security team's detection and response capabilities, making them meaningful indicators of program maturity for leadership.

Under which condition is a security project manager most likely to escalate a governance issue to the executive sponsor?

Answer: When a critical risk decision exceeds the project manager's authority or organizational risk threshold

Escalation to the executive sponsor is warranted when risk decisions or issues fall outside the project manager's scope of authority, requiring senior leadership judgment and accountability.

What is the purpose of a security awareness and training program from a governance perspective?

Answer: To reduce human-factor risk by ensuring all personnel understand their security responsibilities

Security awareness programs address the human element of risk by educating all staff on their roles and responsibilities, reducing susceptibility to phishing, social engineering, and policy violations.

Which governance document provides the formal authorization for a security project manager to use organizational resources and lead a security initiative?

Answer: Project charter

The project charter formally authorizes the project, establishes the project manager's authority, defines objectives, and commits organizational resources to the initiative.

In security governance, the term 'tone at the top' refers to:

Answer: Executive leadership's visible commitment and attitude toward security, which sets the cultural standard

Tone at the top describes how senior leadership's demonstrated commitment to security directly influences organizational culture, compliance behavior, and the overall effectiveness of the security program.