Exam 7: Security Management Practices

Which of the following is NOT a question you should ask when considering best practices for your organization?

Organizations strive to deliver the most value with a given level of investment-this is called the value proposition.

In information security,two categories of benchmarks are used: 1)standards of due care and due diligence and 2)baselining.

The purpose of NIST SP 800-53 (R3)as part of the NIST System C&A Project is to establish a set of standardized,minimum security controls for IT systems addressing low,moderate,and high levels of concern for ____.

In most cases,simply listing the measurements collected does not adequately convey their ____.

A problem with benchmarking is that recommended practices are a(n)____________________; that is,knowing what happened a few years ago does not necessarily tell you what to do next.

Organizations that adopt minimum levels of security to establish a future legal defense may need to verify that they have done what any ____ organization would do in similar circumstances.

In security management,____________________ is the authorization of an IT system to process,store,or transmit information.

Before beginning the process of designing,collecting,and using measures,the CISO should be prepared to answer the following questions posed by Kovacich.List four of these questions.

Organizations pursue accreditation or certification to ____.

To generate a security blueprint,organizations usually draw from established security models and practices.

In some organizations,the terms metrics and best practices are interchangeable._________________________

Under the NIST SP 800-37 security controls model,systems are classified into a specific security certification level.Which of the following is the level of certification for high-priority systems?

Which of the following is a major activity in the information security measures development process,according to NIST?

The biggest barrier to benchmarking in information security is the fact that organizations do not talk to each other.

Accreditation is the authorization of an IT system to process,store,or transmit information.

The last phase in the NIST performance measures implementation process is to apply ____________________ actions; close the gap by implementing the recommended corrective actions in the security program or in the security controls.

The two categories of benchmarks that are used in information security are standards of due care/due diligence and ____________________.

According to NIST SP 800-55: Performance Measurement Guide for Information Security,in phase 4 of measures development,any existing measures and data repositories that can be used to derive measures data should be ____________________.

In selecting among recommended practices,an organization should seek to ensure that the target ____ is similar to their own.