Exam 15: IT Security Controls, Plans, and Procedures

Physical access or environmental controls are only relevant to areashousing the relevant equipment.

The recommended controls need to be compatible with theorganization's systems and policies.

Incident response is part of the ________ class of security controls.

An IT security plan should include details of _________.

Management controls refer to issues that management needs to address.

_______ controls are pervasive, generic, underlying technical IT security capabilities that are interrelated with, and used by, many other controls.

_________ controls focus on preventing security beaches from occurring by inhibiting attempts to violate security policies or exploit a vulnerability.

_______ controls focus on security policies, planning, guidelines, and standards that influence the selection of operational and technical controls to reduce the risk of loss and to protect the organization's mission.

The IT security management process ends with the implementation ofcontrols and the training of personnel.

The three steps for IT security management controls and implementation are: prioritize risks, respond to risks, and __________ .

_______ management is the process used to review proposed changes to systems for implications on the organization's systems and use.

Once in place controls cannot be adjusted, regardless of the results ofrisk assessment of systems in the organization.

A contingency plan for systems critical to a large organization would be _________ than that for a small business.

The objective of the ________ control category is to avoid breaches of any law, statutory, regulatory, or contractual obligations, and of any security requirements.

Contingency planning falls into the _________ class of security controls.

The implementation process is typically monitored by the organizational ______.

Water damage protection is included in security controls.

All controls are applicable to all technologies.

It is likely that the organization will not have the resources toimplement all the recommended controls.

An IT security ________ helps to reduce risks.