Information Security (EXAM1, Chapter 4)

Information Security (EXAM1, Chapter 4) The ISSP is a plan which sets out the requirements that must be met by the information security blueprint or framework. - false The complete details of ISO/IEC 27002 are widely available to everyone. - false NIST 800-14's Principles for Securing Information Technology Systems can be used to make sure the needed key elements of a successful effort are factored into the design of an information security program and to produce a blueprint for an effective security architecture. - True To remain viable, security policies must have a responsible manager, a schedule of reviews, a method for making recommendations for reviews, and a policy issuance and revision date. - true ACLs are more specific to the operation of a system than rule-based policies and they may or may not deal with users directly. - false Evidence is the physical object or documented information that proves an action occurred or identifies the intent of a perpetrator. - true A security policy should begin with a clear statement of purpose. - true The security framework is a more detailed version of the security blueprint. - false Systems-specific security policies are organizational policies that provide detailed, targeted guidance to instruct all members of the organization in the use of a resource, such as one of its processes or technologies. - false One of the basic tenets of security architectures is the layered implementation of security, which is called defense in redundancy. - false To remain viable, security policies must have a responsible individual, a schedule of reviews, a method for making recommendations for reviews, and policy issuance and planned revision dates. - true Managerial controls set the direction and scope of the security process and provide detailed instructions for its conduct. - true In 2016, NIST published a new Federal Master Cybersecurity Framework to create a mandatory framework for managing cybersecurity risk for the delivery of critical infrastructure services at every organization in the United States, based on vendor-specific technologies. - false Some policies may also need a(n) sunset clause indicating their expiration date. - true Guidelines are detailed statements of what must be done to comply with policy. - false A(n) sequential roster is activated as the first person calls a few people on the roster, who in turn call a few other people. - false NIST responded to a mandate and created a voluntary Risk Management Framework that provides an effective approach to manage cybersecurity risks. - true You can create a single, comprehensive ISSP