Deck 13: Policies, Standards and Guidelines

Question 1

To minimize ambiguity, it is a good idea to specify the technologies to be used in a policy

Answer 1

False

Question 2

Policy review is usually triggered by all of the following except

A) Time lapse since last review
B) Change in vendors for significant technologies
C) Significant technology change
D) Changes in regulatory compliance

Answer 2

B

Question 3

A standard is

A) Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so
B) Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources
C) A document that records a high-level principle or course of action that has been decided on
D) A defined set of rules, accepted and adopted by several organizations

Answer 3

D

Question 4

Compliance is

A) Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so
B) Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources
C) Following specifications put forth by policies or legal requirements
D) A defined set of rules, accepted and adopted by several organizations

Question 5

From the perspective of information security, HIPAA defines

A) Requirements for financial institutions to protect the privacy of their customers' non-public, personal information
B) Protections for the privacy of student education records
C) The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data
D) Safeguards that covered entities must use to protect the confidentiality, integrity and availability of electronic protected health information

Question 6

The relationship between policies, standards and guidelines is that

A) Policies and standards emanate from guidelines
B) Standards and guidelines emanate from policies
C) Policies emanate from standards and guidelines
D) Standards, but not guidelines emanate from policies

Question 7

The need for the policy is specified in the

A) Scope
B) Statement
C) Overview
D) Enforcement

Question 8

If an organization specifies that all laptops in the organization will use whole-disk encryption, the specific encryption technology will be specified in a

A) Guideline
B) Standard
C) Policy
D) Law

Question 9

Acceptable use policies describe

A) Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so
B) A defined set of rules, accepted and adopted by several organizations
C) Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources
D) A document that records a high-level principle or course of action that has been decided on

Question 10

How the organization will deal with the situation covered by the policy is specified in the

A) Statement
B) Enforcement
C) Overview
D) Scope

Question 11

Who or what is covered by the policy is specified in the

A) Overview
B) Statement
C) Enforcement
D) Scope

Question 12

It is generally advised to consolidate all policy issues into one policy document

Question 13

The first section of a policy generally specifies

A) Who or what is covered by the policy
B) Any definitions used in the policy
C) The statement of the policy
D) The need for the policy

Question 14

The sections of a policy are generally written in the sequence

A) Overview, scope, definitions, statement, enforcement
B) Definitions, overview, scope, statement, enforcement
C) Overview, definitions, statement, scope, enforcement
D) Overview, enforcement, scope, definitions, statement

Question 15

Activities, settings and measurements accepted by all firms in an industry are

A) Global policies
B) General guidelines
C) Acceptable use policies
D) Industry standards

Question 16

A guideline is

A) Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so
B) Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources
C) A defined set of rules, accepted and adopted by several organizations
D) A document that records a high-level principle or course of action that has been decided on

Question 17

In the United States one of the primary sources of standards for information security concerns is the

A) National Institute of Standards and Technology
B) Massachusetts Institute of Technology
C) Harvard University
D) US State Department

Question 18

Policies, standards and guidelines are useful because they

A) Allow security administrators to obtain executive level endorsement for security objectives
B) Keep managers busy generating documents
C) Allow security administrators to educate the organization's leadership about information security
D) Help in detecting information security incidents

Question 19

Security policies serve all the following functions except

A) Conveying organizational priorities
B) Obtaining managerial backing
C) Evading responsibility
D) Ensuring organizational consistency

Question 20

A policy is

A) Procedures that tell units when it would be nice if things were operated a certain way, but it is not a requirement to do so
B) Guidelines to users and customers on what is appropriate and what is not appropriate to do with information technology resources
C) A document that records a high-level principle or course of action that has been decided on
D) A defined set of rules, accepted and adopted by several organizations

Question 21

From the perspective of information security, the Sarbanes-Oxley SOX act defines

A) Requirements for financial institutions to protect the privacy of their customers' non-public, personal information
B) Protections for the privacy of student education records
C) The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data
D) Safeguards that covered entities must use to protect the confidentiality, integrity and availability of electronic protected health information

Question 22

From the perspective of information security, the Family Educational Rights and Privacy FERPA act defines

A) Requirements for financial institutions to protect the privacy of their customers' non-public, personal information
B) Protections for the privacy of student education records
C) The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data
D) Safeguards that covered entities must use to protect the confidentiality, integrity and availability of electronic protected health information

Question 23

From the perspective of information security, the Gramm-Leach-Bliley GLB act defines

A) Requirements for financial institutions to protect the privacy of their customers' non-public, personal information
B) Protections for the privacy of student education records
C) The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data
D) Safeguards that covered entities must use to protect the confidentiality, integrity and availability of electronic protected health information

Question 24

From the perspective of information security, export control laws defines

A) Requirements for financial institutions to protect the privacy of their customers' non-public, personal information
B) Protections for the privacy of student education records
C) The responsibilities of top executives of publicly traded companies for the accuracy and timeliness of financial data
D) Prohibitions regarding the unlicensed export of specified materials or information

Question 25

Key information security issues for which an organization should have policies include all of the following except

A) Employee count
B) Incident response
C) Acceptable use
D) Information classification