CSSLP · Question #306
Which of the following governance bodies provides management, operational and technical controls to satisfy security requirements?
The correct answer is A. Senior Management. The question asks to identify which governance body provides management, operational, and technical controls to satisfy security requirements within an organization.
Question
Which of the following governance bodies provides management, operational and technical controls to satisfy security requirements?
Options
- ASenior Management
- BBusiness Unit Manager
- CInformation Security Steering Committee
- DChief Information Security Officer
How the community answered
(30 responses)- A93% (28)
- C3% (1)
- D3% (1)
Why each option
The question asks to identify which governance body provides management, operational, and technical controls to satisfy security requirements within an organization.
Senior Management provides management, operational, and technical controls to satisfy security requirements by setting the organizational security policy, allocating resources, and overseeing its implementation throughout the enterprise. They establish the tone from the top for security.
A Business Unit Manager is responsible for security within their specific unit but does not typically provide controls for the entire organization across all three domains (management, operational, technical).
An Information Security Steering Committee provides oversight and guidance on security strategy, but the ultimate provision of controls and overall accountability rests with Senior Management.
A Chief Information Security Officer (CISO) is responsible for implementing and managing security programs, but they operate under the direction and authority provided by Senior Management, who ultimately 'provides' the controls through policy and resource allocation.
Concept tested: Organizational security governance roles
Source: https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.