Question 1

Those procedures that provide a superior level of security for an organization's information.
A) Accreditation
B) Baseline
C) Benchmarking
D) Certification
E) due diligence
F) best security practices
G) recommended business practices
H) standard of due care
I) performance measurements
J) NIST SP 800-37

Accepted Answer

The answer of Those procedures that provide a superior level...

Question 2

List the four factors critical to the success of an InfoSec performance program,according to NIST SP 800-55,Rev.1.

Accepted Answer

The answer of List the four factors critical to the...

Question 3

An attempt to improve information security practices by comparing an organization's efforts against practices of a similar organization or an industry-developed standard to produce results it would like to duplicate.
A) Accreditation
B) Baseline
C) Benchmarking
D) Certification
E) due diligence
F) best security practices
G) recommended business practices
H) standard of due care
I) performance measurements
J) NIST SP 800-37

Accepted Answer

Benchmarking is the process of comparing an organization's efforts against practices of a similar organization or an industry-developed standard to produce results it would like to duplicate. This helps organizations identify areas of improvement and best practices to implement in their own information security practices.

Question 4

The process of implementing a performance measures program recommended by NIST involves six phases. List and describe them.

Accepted Answer

The answer of The process of implementing a performance measures...

Question 5

An assessment of the performance of some action or process against which future performance is assessed.
A) Accreditation
B) Baseline
C) Benchmarking
D) Certification
E) due diligence
F) best security practices
G) recommended business practices
H) standard of due care
I) performance measurements
J) NIST SP 800-37

Accepted Answer

The answer of An assessment of the performance of some...

Question 6

What are the two major activities into which the InfoSec measurement development process recommended by NIST is divided?

Accepted Answer

The answer of What are the two major activities into...

Question 7

Compare and contrast accreditation and certification.

Accepted Answer

The answer of Compare and contrast accreditation and certification....

Question 8

The authorization of an IT system to process,store,or transmit information.
A) Accreditation
B) Baseline
C) Benchmarking
D) Certification
E) due diligence
F) best security practices
G) recommended business practices
H) standard of due care
I) performance measurements
J) NIST SP 800-37

Accepted Answer

Accreditation is the process of evaluating the security controls of an IT system to determine if it meets specific requirements for confidentiality, integrity, and availability. This process evaluates and approves the authorization of an IT system to process, store, or transmit information based on the risk assessment and the security controls in place.

Question 9

Those security efforts that are considered among the best in the industry.
A) Accreditation
B) Baseline
C) Benchmarking
D) Certification
E) due diligence
F) best security practices
G) recommended business practices
H) standard of due care
I) performance measurements
J) NIST SP 800-37

Accepted Answer

The answer of Those security efforts that are considered among...

Question 10

A legal standard that requires an organization and its employees to act as a reasonable and prudent individual or organization would under similar circumstances.
A) Accreditation
B) Baseline
C) Benchmarking
D) Certification
E) due diligence
F) best security practices
G) recommended business practices
H) standard of due care
I) performance measurements
J) NIST SP 800-37

Accepted Answer

Standard of due care is a legal standard that requires an organization and its employees to act as a reasonable and prudent individual or organization would under similar circumstances. This standard is often used as a benchmark for determining whether an organization has met its legal obligations for information security.

Question 11

Why must you do more than simply list the InfoSec measurements collected when reporting them?  Explain.

Accepted Answer

The answer of Why must you do more than simply...

Question 12

A common approach to a Risk Management Framework (RMF)for InfoSec practice.
A) Accreditation
B) Baseline
C) Benchmarking
D) Certification
E) due diligence
F) best security practices
G) recommended business practices
H) standard of due care
I) performance measurements
J) NIST SP 800-37

Accepted Answer

NIST SP 800-37 provides a comprehensive Risk Management Framework for information security practices, including processes for categorizing information systems, selecting appropriate security controls, implementing those controls, assessing their effectiveness, authorizing those systems for operation, and continuously monitoring those systems. All the other choices listed are important components of a risk management framework, but NIST SP 800-37 provides a more comprehensive and widely accepted approach to information security risk management.

Question 13

A comprehensive assessment of a system's technical and nontechnical protection strategies,as specified by a particular set of requirements.
A) Accreditation
B) Baseline
C) Benchmarking
D) Certification
E) due diligence
F) best security practices
G) recommended business practices
H) standard of due care
I) performance measurements
J) NIST SP 800-37

Accepted Answer

Certification involves a comprehensive assessment of a system's technical and non-technical protection strategies to ensure they meet specific requirements.

Question 14

Describe the three tier approach of the RMF as defined by NIST SP 800-37.

Accepted Answer

The answer of Describe the three tier approach of the...

Question 15

The data or the trends in data that may indicate the effectiveness of security countermeasures or controls-technical and managerial-implemented in the organization.
A) Accreditation
B) Baseline
C) Benchmarking
D) Certification
E) due diligence
F) best security practices
G) recommended business practices
H) standard of due care
I) performance measurements
J) NIST SP 800-37

Accepted Answer

Performance measurements are the data or trends that indicate the effectiveness of security countermeasures or controls. The other options listed are related to security frameworks, guidelines, and standards but do not specifically address performance measurements of security controls.

Question 16

Why it measurement prioritization and selection important?  How can it be achieved?

Accepted Answer

The answer of Why it measurement prioritization and selection important?  How...

Question 17

The actions that demonstrate that an organization has made a valid effort to protect others a requirement and that the implemented standards continue to provide the required level of protection.
A) Accreditation
B) Baseline
C) Benchmarking
D) Certification
E) due diligence
F) best security practices
G) recommended business practices
H) standard of due care
I) performance measurements
J) NIST SP 800-37

Accepted Answer

The answer of The actions that demonstrate that an organization...

Question 18

Before beginning the process of designing,collecting,and using measures,the CISO should be prepared to answer the following questions posed by Kovacich. List four of these questions.

Accepted Answer

The answer of Before beginning the process of designing,collecting,and using...

Question 19

On what do measurements collected from production statistics greatly depend?  Explain your answer.

Accepted Answer

The answer of On what do measurements collected from production...

Quiz 9: Security Management Practices

Those procedures that provide a superior level of security for an organization's information.

List the four factors critical to the success of an InfoSec performance program,according to NIST SP 800-55,Rev.1.

An attempt to improve information security practices by comparing an organization's efforts against practices of a similar organization or an industry-developed standard to produce results it would like to duplicate.

The process of implementing a performance measures program recommended by NIST involves six phases. List and describe them.

An assessment of the performance of some action or process against which future performance is assessed.

What are the two major activities into which the InfoSec measurement development process recommended by NIST is divided?

Compare and contrast accreditation and certification.

The authorization of an IT system to process,store,or transmit information.

Those security efforts that are considered among the best in the industry.

A legal standard that requires an organization and its employees to act as a reasonable and prudent individual or organization would under similar circumstances.

Why must you do more than simply list the InfoSec measurements collected when reporting them? Explain.

A common approach to a Risk Management Framework (RMF) for InfoSec practice.

A comprehensive assessment of a system's technical and nontechnical protection strategies,as specified by a particular set of requirements.

Describe the three tier approach of the RMF as defined by NIST SP 800-37.

The data or the trends in data that may indicate the effectiveness of security countermeasures or controls-technical and managerial-implemented in the organization.

Why it measurement prioritization and selection important? How can it be achieved?

The actions that demonstrate that an organization has made a valid effort to protect others a requirement and that the implemented standards continue to provide the required level of protection.

Before beginning the process of designing,collecting,and using measures,the CISO should be prepared to answer the following questions posed by Kovacich. List four of these questions.

On what do measurements collected from production statistics greatly depend? Explain your answer.