CSSLP · Question #72
A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization. Which of the following are required to be addressed in a
The correct answer is A. What is being secured? B. Where is the vulnerability, threat, or risk? D. Who is expected to comply with the policy?. A well-designed security policy must clearly define what assets are being secured, identify potential vulnerabilities, threats, or risks to those assets, and specify who within the organization is responsible for complying with the policy.
Question
A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization. Which of the following are required to be addressed in a well designed policy? Each correct answer represents a part of the solution. Choose all that apply.
Options
- AWhat is being secured?
- BWhere is the vulnerability, threat, or risk?
- CWho is expected to exploit the vulnerability?
- DWho is expected to comply with the policy?
How the community answered
(36 responses)- A86% (31)
- C14% (5)
Why each option
A well-designed security policy must clearly define what assets are being secured, identify potential vulnerabilities, threats, or risks to those assets, and specify who within the organization is responsible for complying with the policy.
A security policy must clearly identify the assets (data, systems, networks) that are being protected.
Understanding the vulnerabilities, threats, or risks helps in formulating appropriate security controls and requirements within the policy to address them.
A security policy focuses on protecting assets and defining behavior, not on identifying who might exploit vulnerabilities.
A policy needs to define its scope of applicability, clearly stating which individuals, roles, or groups are expected to adhere to its rules and guidelines.
Concept tested: Security policy components
Source: https://learn.microsoft.com/en-us/training/modules/define-describe-security-governance/4-understand-security-policies
Topics
Community Discussion
No community discussion yet for this question.