Exam 7: Security Management Practices

Benchmarking can help to determine ____ controls should be considered,but it cannot determine ____ those controls should be implemented in your organization.

In information security,two categories of benchmarks are used: standards of due care and due diligence and ____ practices.

A ____ is a "value or profile of a performance metric against which changes in the performance metric can be usefully compared.".

Maintaining an acceptable level of secure controls over time indicates that an organization has met the standard of ____.

Once developed,information security performance measures must be implemented and integrated into ____ information security management operations.

The first phase in the NIST performance measures methodology is to collect data and analyze results; collect,aggregate,and consolidate metric data collection and compare measurements with targets.

Which of the following is the last phase in the NIST process for performance measures implementation?

Information security ____ is the process of designing,implementing,and managing the use of the collected data elements called measures to determine the effectiveness of the overall security program.

Problems with benchmarking include all but which of the following?

The second step in the NIST SP 800-37 model for security certification and accreditation is to select the appropriate minimum security ____________________ for the system.

One of the three goals of System Certification and Accreditation as defined by NIST is to: define essential maximum security controls for federal IT systems.

In the NIST performance measures implementation process,the comparison of observed measurements with target values is known as a ____ analysis.

In reporting InfoSec performance measures,the CISO must also consider ____.

Security Certification & Accreditation initiative offers several benefits.Which of the following is NOT one of them?

When an organization applies statistical and quantitative forms of mathematical analysis to the data points collected to measure the activities and outcomes of the InfoSec program,it is using InfoSec best practices.

Designing the performance measures collection process requires thoughtful consideration of the ____ of the metric along with a thorough knowledge of how production services are delivered.

One of the priorities in building an information security measures program is determining whether these measures will be macro-focus or micro-focus.____ measures examine the performance of the overall security program.

Security efforts that seek to provide a superior level of performance in the protection of information are called ____.

One of the critical tasks in the measurement process is to assess and quantify what will be secured._________________________

In information security,two categories of benchmarks are used: standards of due care and due diligence and recommended practices._________________________