nerdexam
(ISC)2

CSSLP · Question #316

The mission and business process level is the Tier 2. What are the various Tier 2 activities? Each correct answer represents a complete solution. Choose all that apply.

The correct answer is A. Developing an organization-wide information protection strategy and incorporating high-level information B. Defining the types of information that the organization needs, to successfully execute the stated missions C. Specifying the degree of autonomy for the subordinate organizations D. Defining the core missions and business processes for the organization E. Prioritizing missions and business processes with respect to the goals and objectives of the organization. Tier 2 (Mission/Business Process Level) activities involve defining core missions and processes, prioritizing them, specifying subordinate autonomy, developing an organization-wide information protection strategy, and identifying necessary information types.

Secure Software Lifecycle Management

Question

The mission and business process level is the Tier 2. What are the various Tier 2 activities? Each correct answer represents a complete solution. Choose all that apply.

Options

  • ADeveloping an organization-wide information protection strategy and incorporating high-level information
  • BDefining the types of information that the organization needs, to successfully execute the stated missions
  • CSpecifying the degree of autonomy for the subordinate organizations
  • DDefining the core missions and business processes for the organization
  • EPrioritizing missions and business processes with respect to the goals and objectives of the organization

How the community answered

(32 responses)
  • A
    100% (32)

Why each option

Tier 2 (Mission/Business Process Level) activities involve defining core missions and processes, prioritizing them, specifying subordinate autonomy, developing an organization-wide information protection strategy, and identifying necessary information types.

ADeveloping an organization-wide information protection strategy and incorporating high-level informationCorrect

Developing an organization-wide information protection strategy and incorporating high-level information is a key activity at the Tier 2 level, translating organizational goals into security directives.

BDefining the types of information that the organization needs, to successfully execute the stated missionsCorrect

Defining the types of information that the organization needs to successfully execute the stated missions is crucial at Tier 2 to inform subsequent information system design and protection.

CSpecifying the degree of autonomy for the subordinate organizationsCorrect

Specifying the degree of autonomy for the subordinate organizations is a management decision at Tier 2 that influences how security policies are implemented across the enterprise.

DDefining the core missions and business processes for the organizationCorrect

Defining the core missions and business processes for the organization forms the foundation for all security decisions, identifying what needs protection and why, and is a fundamental Tier 2 activity.

EPrioritizing missions and business processes with respect to the goals and objectives of the organizationCorrect

Prioritizing missions and business processes with respect to the goals and objectives of the organization allows for the allocation of security resources effectively based on the organization's strategic goals and objectives, a critical Tier 2 function.

Concept tested: NIST RMF Tiers - Tier 2 (Mission/Business Process)

Source: https://csrc.nist.gov/publications/detail/sp/800-39/final

Topics

#Tier 2 activities#Organizational security strategy#Mission and business processes#Information protection framework

Community Discussion

No community discussion yet for this question.

Full CSSLP Practice