Information Governance Framework & Policies Flashcards

Which standard provides a globally recognized framework specifically for information security management systems (ISMS)?

Answer: ISO/IEC 27001

ISO/IEC 27001 is the international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS.

In an IG framework, a 'policy' differs from a 'procedure' primarily because a policy:

Answer: States the organization's intent and high-level rules

Policies express organizational intent and mandatory rules, while procedures provide the step-by-step instructions for implementing those policies.

The ARMA International Generally Accepted Recordkeeping Principles (GARP) include how many core principles?

Answer: 8

ARMA's GARP framework consists of 8 core principles: Accountability, Transparency, Integrity, Protection, Compliance, Availability, Retention, and Disposition.

When developing an IG policy for email, which element is MOST critical to include to ensure legal defensibility?

Answer: Retention schedule aligned with legal holds and regulations

A legally defensible email policy must include retention schedules that align with applicable regulations and the organization's legal hold obligations.

Which governance body is typically responsible for approving enterprise-level IG policies?

Answer: Executive leadership or a steering committee

Enterprise IG policies require approval at the executive or steering committee level to ensure enterprise-wide authority and cross-departmental compliance.

A gap analysis in IG framework development is used to:

Answer: Identify differences between the current state and desired IG program maturity

A gap analysis compares the organization's current IG capabilities and practices against its desired or required state to prioritize improvements.

Under the principle of 'least privilege' in information governance, access to sensitive information should be granted:

Answer: Only to the minimum number of users required to perform their job functions

Least privilege limits information access to only those who need it to perform their duties, reducing the risk of unauthorized disclosure or misuse.