Exam 14: IT Security Management and Risk Assessment

The intent of the ________ is to provide a clear overview of how an organization's IT infrastructure supports its overall business objectives.

IT security needs to be a key part of an organization's overallmanagement plan.

The purpose of ________ is to determine the basic parameters within which the risk assessment will be conducted and then to identify the assets to be examined.

________ specification indicates the impact on the organization should the particular threat in question actually eventuate.

It is not critical that an organization's IT security policy have fullapproval or buy-in by senior management.