CSS Security Policy Development & Enforcement 2

Question 1

Under the NIST Cybersecurity Framework, which function encompasses the development of organizational security policies?

Accepted Answer

Identify

Answer

The Identify function includes governance activities such as establishing cybersecurity policies, roles, and responsibilities.

Question 2

A security policy states that all employees must complete annual security awareness training. Which policy enforcement mechanism is MOST effective for ensuring compliance?

Accepted Answer

Linking training completion to annual performance reviews

Answer

Tying training completion to performance reviews creates an organizational accountability mechanism that directly motivates compliance.

Question 3

Which document type provides step-by-step instructions for implementing a security policy requirement?

Accepted Answer

Procedure

Answer

Procedures are detailed, step-by-step instructions that tell employees exactly how to carry out policy requirements.

Question 4

An organization's acceptable use policy (AUP) is BEST described as which type of security policy?

Accepted Answer

Issue-specific policy

Answer

Issue-specific policies address particular topics such as acceptable use of organizational assets and systems.

Question 5

During a policy review cycle, a security manager discovers that a control in the data classification policy conflicts with a recently enacted state privacy law. What is the FIRST action to take?

Accepted Answer

Update the policy to align with the law after management approval

Answer

Regulatory requirements supersede internal policy, so the policy must be updated through the formal change process to achieve legal compliance.

(CSS) Certified Security Sentinel Practice Test

(CSS) Certified Security Sentinel Practice Test

CSS Security Policy Development & Enforcement 2