CNET251 Chapt 3 Governance & Strategic Planning for Security

Which of the following is used to declare the intended areas of operation for a business?

• Values statement

• Vision statement

• Objectives statement

• Mission Statement

Organizational planning should make use of a bottom-up process in which the employees choose the initiatives the organization should pursue.

• True

• False

A multilayered approach to strategic planning encompasses two key objectives: general strategy and which of the following?

• overall strategic planning

• Archived profiling

• Organizational profiling

• InfoSec planning

Which of the following best describes a stakeholder?

• An individual or group that owns financial stock in an organization

• A competing organization

• An individual who buys an organization's products

• An individual or group who has a vested interest

Which of the following is used to establish a formal set of organizational principles and qualities for an organization?

• Values statement

• Vision statement

• Mission statement

• Morals statement

Which phase of the CGTF framework involves determining where you are relative to where you want to be?

• Initiating

• Diagnosing

• Establishing

• Learning

InfoSec objectives must be addressed at the highest levels of an organization's management team in order to be effective and offer a sustainable approach.

• True

• False

According to the IDEAL framework, which functional role should be responsible for communicating policies to employees and coordinate training?

• Chief Executive Officer

• Chief Risk Officer

• Mid-Level Manager

• Enterprise Staff

Which of the following governance processes, as outlined in ISO 27014:2013, involves the review and assessment of organizational information security performance toward goals and objectives by the governing body?

• Monitor

• Direct

• Communicate

• Assure

Why is the bottom-up approach less effective than the top-down approach?

• Lack of technical support

• Lack of management support

• Lack of stakeholder support

• Lack of stockholder support