CSPM Security Governance & Leadership Flashcards

In security project management, which governance document defines the acceptable use of organizational IT resources by employees?

Answer: Acceptable Use Policy (AUP)

An Acceptable Use Policy (AUP) establishes the rules and restrictions governing how employees may use organizational technology assets, networks, and data.

Which role in a security governance structure is ultimately accountable for accepting residual risk on behalf of the organization?

Answer: Authorizing Official (AO)

The Authorizing Official (AO), typically a senior executive, formally accepts residual risk and grants the Authority to Operate (ATO) for a system under NIST RMF.

A security governance framework ensures strategic alignment by linking security objectives to:

Answer: Overall business goals and mission objectives

Effective security governance aligns cybersecurity investments and objectives with the organization's overarching business strategy, ensuring security enables rather than hinders mission success.

What is the primary function of a security steering committee in a large organization?

Answer: Providing executive oversight and strategic direction for the security program

A security steering committee brings together executive and senior leadership to set strategic security priorities, approve major decisions, and ensure program alignment with business goals.

The concept of 'separation of duties' in security governance is primarily designed to:

Answer: Prevent fraud and errors by ensuring no single person controls an entire process

Separation of duties divides critical processes among multiple individuals to reduce the risk of insider fraud, error, or abuse by ensuring no single employee has complete control.

Which security governance principle requires that users be granted only the minimum access rights necessary to perform their job functions?

Answer: Least privilege

The principle of least privilege restricts user access rights to only what is strictly required for their role, minimizing the potential damage from compromised accounts or insider threats.