Exam 7: Security Management Practices

One of the priorities in building an information security measures program is determining whether these measures will be macro-focus or micro-focus.

During Phase 2 of the NIST performance measures development process,the organization will identify and document the information security performance ____ that would guide security control implementation for the information security program of a specific information system.

One of the most popular of the many references that support the development of process improvement and performance measures is The Capability Maturity Model Integrated (CMMI)designed specifically to integrate an organization's process improvement activities across disciplines._________________________

One of the fundamental challenges in information security performance measurement is the definition of ____ security.

Performance measurement is an ongoing,continuous improvement operation._________________________

Security efforts that seek to provide a(n)acceptable level of performance in the protection of information are called recommended business practices or just best practices._________________________

It is seldom advisable to broadcast complex and nuanced metrics-based reports to large groups,unless ____.

Collecting project metrics may be even more challenging.Unless the organization is satisfied with a simple tally of who spent how many hours doing which tasks,it needs some mechanism to link the ____ of each project,in terms of loss control or risk reduction,to the resources consumed.

According to NIST SP 800-37,the first step in the security controls selection process is to ____.

Which of the following is NOT a question a CISO should be prepared to answer,about a performance measures program,according to Kovacich?

Information security performance management is the process of designing,implementing,and managing the use of the collected data elements called measures to determine the effectiveness of the overall security program.

When an organization applies statistical and quantitative forms of mathematical analysis to the data points collected to measure the activities and outcomes of the InfoSec program,it is using InfoSec ____________________.

The benefits of using information security performance measures include all but which of the following?

One of the most popular references for developing process improvement and performance measures is the ____ model from the Software Engineering Institute at Carnegie Mellon University.

A goal of 100 percent employee information security training in the training program would invalidate the continued collection of training measures._________________________

Security efforts that seek to provide a superior level of performance in the protection of information are referred to as ____________________.

In the future,NIST plans to replace accreditation with ____ and certification with ____.

A(n)____________________ is an external "value or profile of a performance metric against which changes in the performance metric can be usefully compared."

List the four factors critical to the success of an information security performance program,according to NIST SP 800-55.

Strong upper level management support is critical to the success of an information security performance program._________________________