Which of the following documents is defined as a source document, which is most useful for the ISSE when classifying the needed security functionality?

Question

Options

• AInformation Protection Policy (IPP)
• BIMM
• CSystem Security Context
• DCONOPS

• A
  95% (19)
• B
  5% (1)

Explanation

Option A is correct because the Information Protection Policy (IPP) is the foundational source document that defines what information assets exist, their sensitivity levels, and the protection requirements - giving the ISSE the raw material needed to classify and specify required security functionality for a system.

Why the distractors are wrong:

• B (IMM - Information Management Manual): Covers broader information management procedures and governance, not a targeted source for security classification inputs.
• C (System Security Context): This is an output or artifact the ISSE produces during analysis, not a source document they draw from.
• D (CONOPS - Concept of Operations): Describes how a system will be used operationally, which informs threat modeling and use cases, but doesn't directly define information sensitivity or protection classification requirements.

Memory tip: Think of the IPP as the ISSE's "shopping list" - it tells you what needs protecting and how much, which is exactly what you need before you can decide which security functions to build in.

No community discussion yet for this question.