Exam 4: Information Security Policy

According to Charles Cresson Wood "policies are important reference documents for internal ____ and for the resolution of legal disputes about management's due diligence; policy documents can act as a clear statement of management's intent".

The ____ component of an EISP defines the organizational structure designed to support information security within the organization.

To ensure due diligence an organization must demonstrate that it is continuously attempting to meet the requirements of the market in which it operates._________________________

An individual approach to creating the ISSPs is well controlled by centrally managed procedures assuring complete topic coverage.

In some organizations,that which is not permitted is ____________________ while in other organizations,the reverse is true.

If an organization wants to prohibit the criminal use of the organization's information systems,it should do so in the Systems Management section of the ISSP._________________________

Practices,procedures,and ____________________ consist of detailed steps that must meet the requirements of standards.

For policies to be effective,they must first be developed using generally-accepted practices._________________________

A ____ specifies which subjects and objects users or groups can access.

The ISSP is not a binding agreement between the organization and its members.

A quality information security program begins and ends with policy.

Access control lists can only be used to restrict access according to the user.

A(n)individual approach to creating the ISSPs can suffer from poor policy dissemination,enforcement,and review._________________________

The information security policy is written during the ____ phase of the SecSDLC.

____________________ include the user access lists,matrices,and capability tables that govern the rights and privileges of users.

Users have the right to use an organization's information systems to browse the Web,even if this right is not specified in the ISSP.

To be certain that employees understand the policy,the document must be written at a reasonable reading level with minimal ____.

A ____ is a more detailed statement identifying a measurement of behavior and specifies what must be done to comply with a policy.

A(n)____________________ issue-specific security policy document unifies policy creation and administration,while maintaining each specific issue's requirements.

In some systems,capability tables are known as user profiles.