Some security measures are optional. Other security measures must always be implemented. Which measure(s) must always be implemented?

Question

Options

• AClear Desk Policy
• BPhysical security measures
• CLogical access security measures
• DMeasures required by laws and regulations

• A
  10% (2)
• C
  5% (1)
• D
  86% (18)

Explanation

Laws and regulations create mandatory obligations that organizations must fulfill regardless of cost, preference, or risk appetite - non-compliance can result in legal penalties, fines, or loss of operating licenses, making option D the only universally required category. A Clear Desk Policy (A) is a best practice but remains discretionary based on organizational context and risk tolerance. Physical security measures (B) and logical access controls (C) are both critically important and widely recommended, but their specific implementation varies by environment - a small startup and a bank have very different requirements, and neither is universally mandated across all contexts. The key distinction is who mandates the measure: internal policy choices (A, B, C) can be skipped or tailored, but external legal requirements (D) cannot.

Memory tip: Think "D = Demanded by law." If a regulator can fine or shut you down for skipping it, it's mandatory - everything else is a professional judgment call.

No community discussion yet for this question.