CHAPTER SUMMARY

Policy framework development is needed for the establishment and ongoing operation of the organization’s security program. It establishes the top leadership’s intent as to how information security should be managed. This program begins with documentation in the form of policies, standards, baselines, procedures, and guidance for compliance. The library of documents is arranged as a hierarchy with the highest level consisting of a charter. The next level includes policies, followed by an increasing number of standard and baseline documents. These documents are supplemented with guidelines to aid in implementation. Finally, many procedure documents that explicitly describe how to implement a security control or process are included. The library should be developed and managed by dedicated personnel who are experts in the subject matter related to the organization’s industry or mission.

Any effective IT security program includes top-down sponsorship to establish and enforce these policies and standards. This framework of documents identifies how an organization manages security risk within its risk appetite and risk tolerance. Because information security never stands still for long, most of the documents in a policy and standards library must be considered living documents that are updated as technology and the environment changes.

KEY CONCEPTS AND TERMS

Compliance

Dormant account

Exception

Granularity

Information security program charter

ISO/IEC 27000 series

Issue-specific standard

IT policy framework

NIST SP 800-53

Risk appetite

System-specific standard

CHAPTER 6 ASSESSMENT

  1. An IT policy framework charter includes which of the following?
    1. The program’s purpose and mission
    2. The program’s scope within the organization
    3. Assignment of responsibilities for program implementation
    4. Compliance management
    5. A, B, and C only
    6. A, B, C, and D
  2. Which of the following is the first step in establishing an information security program?
    1. Adoption of an information security policy framework or charter
    2. Development and implementation of an information security standards manual
    3. Development of a security awareness training program for employees
    4. Purchase of security access control software
  3. Which of the following are generally accepted and widely used policy frameworks? (Select all that apply.)
    1. COBIT
    2. ISO/IEC 27002
    3. NIST SP 800-53
    4. NIPP
  4. Security policies provide the “what” and “why” of security measures.
    1. True
    2. False
  5. ________ are best defined as high-level statements, beliefs, goals, and objectives.
  6. Which of the following is not mandatory?
    1. Standard
    2. Guideline
    3. Procedure
    4. Baseline
  7. Which of the following includes all of the detailed actions and tasks that personnel are required to follow?
    1. Standard
    2. Guideline
    3. Procedure
    4. Baseline
  8. Accounts that have not been accessed for an extended period of time are often referred to as ________.
  9. Upperalpha the five tenets of information assurance that you should consider when building an IT policy framework.
  10. The purpose of a consequence model is to discipline an employee in order to ensure future compliance with information security policies.
    1. True
    2. False
  11. When building a policy framework, which of the following information systems factors should be considered?
    1. Unauthorized access to and use of the system
    2. Unauthorized disclosure of information
    3. Disruption of the system
    4. Modification of information
    5. Destruction of information resources
    6. A, B, and E only
    7. A, B, C, D, and E
  12. What is the difference between risk appetite and risk tolerance?
    1. Risk tolerance measures impact and likelihood, whereas risk appetite measures variance from a target goal.
    2. Risk appetite measures impact and likelihood, whereas risk tolerance measures variance from a target goal.
    3. There is no difference between the two.
  13. A mitigating control eliminates the risk by achieving the policy goal in a different way.
    1. True
    2. False

ENDNOTES

1. Alberta Health Services, “Policy Development Framework,” April 25, 2016,https://extranet.ahsnet.ca/teams/policydocuments/1/clp-pdf-pol-devt-framework.pdf, accessed April 18, 2020.

2. University of Huddlesfield, “Policy Framework,” https://www.hud.ac.uk/media/policydocuments/Policy-Framework.pdf, accessed April 18, 2020.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.224.31.41