Exam 7: Security Management Practices

Which of the following is the first phase in the NIST process for performance measures implementation?

In security management,____ is "the comprehensive evaluation of the technical and nontechnical security controls of an IT system to support the process that establishes the extent to which a particular design and implementation meets a set of specified security requirements.

Another way to create a blueprint is to look at the paths taken by organizations similar to the one whose plan you are developing,known as baselining.

One of the factors critical to the success of an information security performance program is practical information security ____________________ and procedures.

Best security practices balance the need for information ____________________ with the need for adequate protection while simultaneously demonstrating fiscal responsibility.

Performance ____________________ make it possible to define success in the security program.

"Good security now is better than perfect security never."

Which of the following would NOT be a valuable performance measure?

Which of the following is NOT a factor critical to the success of an information security performance program?

One of the critical tasks in the performance measurement process is to assess and ____ what will be measured.

Because "organizations ____________________ what they measure," it is important to ensure that individual metrics are prioritized in the same manner as the performance they measure.

Which of the following is NOT one of the three types of performance measures used by organizations?

When choosing from among recommended practices,an organization should ask if it resembles the target organization of the recommended practice._________________________

Another problem with benchmarking is that no two organizations are similar._________________________

In security management,____ is the authorization of an IT system to process,store,or transmit information.

Once developed,information security performance measures must be implemented and integrated into ongoing information security management operations.For the most part,it is sufficient to collect these measures once.

Industries that are regulated by governmental agencies are required to meet government guidelines in their security practices._________________________

Because "organizations manage what they measure," it is important to ensure that individual metrics are reported in the same manner as the performance they measure._________________________

The typical length of certification and/or accreditation is ____.

The platinum standard is a model level of performance that demonstrates industrial leadership,quality,and concern for the protection of information.