PRE 5 Q.3

It apply to a set of information systems or a wide cross-section of the computing environment of the organization.

• Scoping guidance

• Compensating control

• Common security control

• Security planning process

The purpose of this is to ensure that the system or application behaves according to the design manual containing the security solutions included in the security plan.

• Strategic security analysis

• Strategic security design

• Strategic security choice

• Strategic security review

It provides organizations with specific technology-related, infrastructure-related, public access-related, scalability-related, common security control-related, and risk-related considerations on the applicability and implementation of individual security controls in the control baseline.

• Scoping guidance

• Compensating controls

• Security controls

• Information controls

It constitute the managerial, operational, and technical controls employed by an organization in lieu of the recommended controls in the low, moderate, or high baselines.

• Scoping guidance

• Compensating controls

• Security controls

• Information controls

This is the first phase of developing an organization’s security plan.

• Strategic security definition

• Strategic security analysis

• Strategic security design

• Strategic security choice

It will consist of the organization’s security requirements in terms of managerial, operational, and technical security controls that are capable of providing adequate security for the organization for the next 3 years.

• Information security

• Security system

• Security management

• Security plan

It defines security control measures for the system or application being studied.

• Strategic security definition

• Strategic security analysis

• Strategic security design

• Strategic security choice

It is the most critical element of an IT security program as it identifies the rules and procedures that all persons accessing computer resources must adhere to in order to ensure the confidentiality, integrity, and availability of data and resources.

• Security plan

• Security policy

• Security management

• Security methodology

The purpose of this for an information system is to define its security requirements for the long term.

• Information security

• Security method

• Security management

• Security plan

The purpose of this is to make sure that all recommendations included in the final version of the SP are the most appropriate possible.

• Strategic security analysis

• Strategic security design

• Strategic security choice

• Strategic security review