Cism Exam (A+ Graded)

____________________ ______________________ will define the approach to achieving the security program outcomes management wants. It should also be a statement of how security aligns with and supports business objectives. It proved the basis for good security governance. correct answers Security strategy A security strategy is important for an enterprise primarily because it: correct answers provides the approach to achieving the outcomes management wants The most important consideration in developing security policies is that: correct answers They are based on a threat profile The primary security objective in creating good procedures is: correct answers that they are unambiguous and meet standards From an information security manager's perspective, the most important factors regarding data retention are: correct answers business and regulatory requirements which role is in the best position to review and confirm the appropriateness of a list of approved users correct answers data owner in implementing information security governance, the information security manager is primarily responsible for: correct answers developing the security strategy Security failures are, in the majority of instances, directly related to ___________________ or __________________________________________. Communication is important to ensure continued awareness of security policies and procedures among staff and business partners correct answers lack of awareness; failure of employees to follow policies or procedures Why should you treat regulatory requirements as just another risk? correct answers because departments such as human resources, finance and legal are most often subject to new regulations and must be involved in determining how best to meet the existing and emerging requirements, they typically would be most aware of these regulations. Treating regulations as another risk puts them in proper perspective, and the mechanism to deal with them should already exist. The basis for developing relevant security policies is address viable __________ to the enterprise, prioritized by the likelihood of ____________ and their potential ____________ on the business. correct answers threats; occurence, impact The strictest policies apply to areas of: correct answers greatest business value The first criterion must be to ensure that there is no ambiguity in the ________________ and that, from a security perspective, they meet the applicable standards and comply with ______________ correct answers procedures; policy