Exam 9: Security Management Practices

Standardization is an an attempt to improve information security practices by comparing anorganization's efforts against those of a similar organization or an industry-developedstandard to produce results it would like to duplicate.____________

Using a practice called baselining,you are able to develop policy based on the typical practices of the industry in which you are working.

Attaining certification in security management is a long and difficult process,but once attained,an organization remains certified for the life of the organization.

Recommended practices are those security efforts that seek to provide a superior level of performancein the protection of information.____________

Compare and contrast accreditation and certification.

The InfoSec measurement development process recommended by NIST isis divided into two major activities.Which of the following is one of them?

One of the critical tasks in the measurement process is to assess and quantify what willbe measured and how it is measured.____________

Which of the following is the first phase in the NIST process for performance measurement implementation?

Describe the three tier approach of the RMF as defined by NIST SP 800-37.

Which of the following is a possible result of failure to establish and maintain standards of due care and due diligence?

Which of the following is Tier 3 (indicating environment of operation)of the tiered risk management approach?

Why must you do more than simply list the InfoSec measurements collected when reporting them?Explain.

When choosing from among recommended practices,an organization should consider a number of questions.List four.

On what do measurements collected from production statistics greatly depend?Explain your answer.

What are the legal requirements that an organization adopt a standard based on what a prudent organization should do,and then maintain that standard?

A goal of 100 percent employee InfoSec training as an objective for the training program is an example of a performance __________.

Creating a blueprint by looking at the paths taken by organizations similar to the one whose plan you are developing is known as which of the following?

Before beginning the process of designing,collecting,and using measures,the CISO should be prepared to answer the following questions posed by Kovacich.List four of these questions.

Which of the following is NOT a question a CISO should be prepared to answer,about a performance measures program,according to Kovacich?

An attempt to improve information security practices by comparing anorganization's efforts against practices of a similar organization or an industry-developedstandard to produce results it would like to duplicate.