Question 51
Which of the following is the MOST important reason for an organization to develop an information security governance program?
- Establishment of accountability
- Compliance with audit requirements
- Creation of tactical solutions
- Monitoring of security incidents
Question 52
Which of the following provides the MOST essential input for the development of an information security strategy?
- Results of an information security gap analysis
- Measurement of security performance against IT goals
- Results of a technology risk assessment
- Availability of capable information security resources
Question 53
The MOST important reason for an information security manager to be involved in the change management process is to ensure that:
- security controls drive technology changes.
- risks have been evaluated.
- security controls are updated regularly.
- potential vulnerabilities are identified.
Question 54
Which of the following should be the PRIMARY focus of a status report on the information security program to senior management?
- Confirming the organization complies with security policies
- Verifying security costs do not exceed the budget
- Demonstrating risk is managed at the desired level
- Providing evidence that resources are performing as expected
Question 55
Which of the following is MOST likely to be a component of a security incident escalation policy?
- Names and telephone numbers of key management personnel
- A severity-ranking mechanism tied only to the duration of the outage
- Sample scripts and press releases for statements to media
- Decision criteria for when to alert various groups