Exam 4: Information Security Policy

In the modular approach to creating the ISSP,each of the modules is created and updated by the individuals who are responsible for a specific issue.

An organization may include a set of disclaimers in the ____ section of the ISSP.

The ____________________ layer is the place where threats from public networks meet the organization's networking infrastructure in the bull's-eye model.

The Prohibited Usage of Equipment section of the ISSP specifies the penalties and repercussions of violating the usage and systems management policies._________________________

To ensure ____,an organization must demonstrate that it is continuously attempting to meet the requirements of the market in which it operates.

A detailed outline of the scope of the policy development project is created during the ____ phase of the SecSDLC.

For most corporate documents,a score of ____ is preferred as a Flesch-Kincaid Grade Level score.

Information security policies do not require a champion.

Which of the following would not necessarily be a good reference or resource in writing good policy documents from scratch?

The three types of information security policies include enterprise information security program policy,issue-specific security policies,and ____________________ security policies.

____ are used to create procedures.

When more than two audiences are to be addressed by separate policy documents,it is recommended that a(n)____________________ be prepared before actually writing the first draft policy documents.

According to Confucius,"Tell me,and I forget; show me,and I remember; let me do and I ____."

A(n)____________________ screen is an acknowledgment screen that does not require any unusual action on the part of the user to move past the screen.

A policy should be "signed into law" by a high-level manager before the collection and review of employee input.

Information security is defined in the ____ component of an EISP.

Access control lists can be used to control access to file storage systems.

A risk assessment is performed during the ____ phase of the SecSDLC.

Policies must also specify the penalties for unacceptable behavior and define a(n)____.

Typically,the information security policy administrator is ____.