CSSLP · Question #316
The mission and business process level is the Tier 2. What are the various Tier 2 activities? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is A. Developing an organization-wide information protection strategy and incorporating high-level information B. Defining the types of information that the organization needs, to successfully execute the stated missions C. Specifying the degree of autonomy for the subordinate organizations D. Defining the core missions and business processes for the organization E. Prioritizing missions and business processes with respect to the goals and objectives of the organization. Tier 2 (Mission/Business Process Level) activities involve defining core missions and processes, prioritizing them, specifying subordinate autonomy, developing an organization-wide information protection strategy, and identifying necessary information types.
Question
The mission and business process level is the Tier 2. What are the various Tier 2 activities? Each correct answer represents a complete solution. Choose all that apply.
Options
- ADeveloping an organization-wide information protection strategy and incorporating high-level information
- BDefining the types of information that the organization needs, to successfully execute the stated missions
- CSpecifying the degree of autonomy for the subordinate organizations
- DDefining the core missions and business processes for the organization
- EPrioritizing missions and business processes with respect to the goals and objectives of the organization
How the community answered
(32 responses)- A100% (32)
Why each option
Tier 2 (Mission/Business Process Level) activities involve defining core missions and processes, prioritizing them, specifying subordinate autonomy, developing an organization-wide information protection strategy, and identifying necessary information types.
Developing an organization-wide information protection strategy and incorporating high-level information is a key activity at the Tier 2 level, translating organizational goals into security directives.
Defining the types of information that the organization needs to successfully execute the stated missions is crucial at Tier 2 to inform subsequent information system design and protection.
Specifying the degree of autonomy for the subordinate organizations is a management decision at Tier 2 that influences how security policies are implemented across the enterprise.
Defining the core missions and business processes for the organization forms the foundation for all security decisions, identifying what needs protection and why, and is a fundamental Tier 2 activity.
Prioritizing missions and business processes with respect to the goals and objectives of the organization allows for the allocation of security resources effectively based on the organization's strategic goals and objectives, a critical Tier 2 function.
Concept tested: NIST RMF Tiers - Tier 2 (Mission/Business Process)
Source: https://csrc.nist.gov/publications/detail/sp/800-39/final
Topics
Community Discussion
No community discussion yet for this question.