Exam 4: Information Security Policy

A(n)____ security policy provides detailed,targeted guidance to instruct all members of the organization in the use of technology-based systems.

Technical controls ____.

The champion and manager of the information security policy is called the ____________________.

During the implementation phase of the policy development SecSDLC,the development team creating the information security policy should make sure that the policy is written at a reasonable reading level._________________________

A disadvantage of creating a modular ISSP document is that it ____.

It is recommended that the ____ approach(es)to creating and managing ISSPs be used.

Once policies are created,they should not be changed.

Unless a particular use is clearly prohibited,the organization cannot penalize employees for it.

The ISSP should begin with a ____.

An effective issue-specific security policy serves to demonstrate that the organization has made a good-faith effort to ensure that its facilities will not be used in an inappropriate manner._________________________

In the Flesch Reading Ease scale,the higher the score,the harder it is to understand the writing.

Many organizations create a single document that combines elements of both the management guidance SysSP and the technical specifications SysSP,known as a(n)____.

The EISP guides the development,implementation,and management requirements of the information security program._________________________

The ____ model describes the layers at which marginal assessment of security controls can be performed and is a proven mechanism for prioritizing complex changes.

The ____________________ phase is the last phase of the SecSDLC.

All the application systems of an organization are part of the ____________________ layer in the bull's-eye model.

Capability tables are also known as ____.

Policies should be published without a date of origin.

Rule-based policies are less specific to the operation of a system than access control lists.

Which of the following sections of the ISSP should provide instructions on how to report observed or suspected violations?