nerdexam
(ISC)2

CGRC · Question #443

Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Which of the…

The correct answer is A. Human resources security B. Organization of information security C. Risk assessment and treatment. International information security standards, such as those in the ISO/IEC 27000 family, comprehensively cover domains like human resources security, the organization of information security, and risk assessment and treatment.

Selection and Approval of Framework, Security, and Privacy Controls

Question

Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security controls. Which of the following are the international information security standards? Each correct answer represents a complete solution. Choose all that apply. Response:

Options

  • AHuman resources security
  • BOrganization of information security
  • CRisk assessment and treatment
  • DAU audit and accountability

How the community answered

(27 responses)
  • A
    89% (24)
  • D
    11% (3)

Why each option

International information security standards, such as those in the ISO/IEC 27000 family, comprehensively cover domains like human resources security, the organization of information security, and risk assessment and treatment.

AHuman resources securityCorrect

Human resources security is a domain covered by international standards like ISO/IEC 27002 (Annex A.7), which provides controls for managing personnel-related security risks.

BOrganization of information securityCorrect

Organization of information security is a foundational area within international standards like ISO/IEC 27002 (Annex A.5), focusing on the internal organizational structure and responsibilities for managing information security.

CRisk assessment and treatmentCorrect

Risk assessment and treatment are central components of international information security management systems, such as those defined by ISO/IEC 27001 and 27002, guiding organizations on how to identify, analyze, and mitigate information security risks.

DAU audit and accountability

"AU audit and accountability" refers to a control family within NIST publications (e.g., NIST SP 800-53), which are U.S. federal standards, not typically categorized as international information security standards.

Concept tested: ISO/IEC 27000 series control domains

Source: https://www.iso.org/standard/27002.html

Topics

#ISO 27002#International Standards#Information Security Controls#Standard Frameworks

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice