CGEIT · Question #222
IT security is concerned with employees' increasing use of personal equipment for work-related purposes, while employees claim it allows them to be more productive. A decision on whether to modify…
The correct answer is D. a risk and benefit evaluation. A decision to modify the enterprise information security policy regarding personal equipment use should be based on a comprehensive risk and benefit evaluation to balance security concerns with potential productivity gains.
Question
IT security is concerned with employees' increasing use of personal equipment for work-related purposes, while employees claim it allows them to be more productive. A decision on whether to modify the enterprise information security policy should be based on:
Options
- Aaudit findings.
- Buser access approval procedures.
- Cthe impact to security.
- Da risk and benefit evaluation.
How the community answered
(48 responses)- A21% (10)
- B13% (6)
- C6% (3)
- D60% (29)
Why each option
A decision to modify the enterprise information security policy regarding personal equipment use should be based on a comprehensive risk and benefit evaluation to balance security concerns with potential productivity gains.
Audit findings might reveal current compliance issues but do not inherently provide the forward-looking assessment of risks and benefits needed for policy modification.
User access approval procedures are a control mechanism within a policy, not the basis for deciding whether to modify the policy itself regarding personal equipment.
While the impact to security is a critical factor, it represents only one side of the equation; the benefits (productivity) must also be considered for a balanced decision.
Modifying a security policy for a BYOD (Bring Your Own Device) scenario requires a thorough risk and benefit evaluation. This process identifies potential security risks introduced by personal devices, assesses their likelihood and impact, and weighs them against the productivity benefits and cost savings, allowing for an informed decision that balances security with business needs.
Concept tested: BYOD policy decision-making, risk-benefit analysis
Source: https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-governance-strategy-management#gs-2-define-and-implement-security-metrics
Topics
Community Discussion
No community discussion yet for this question.