Scenario: You are the newly hired Chief Information Security Officer for a company that has not previously had a senior level security practitioner. The company lacks a defined security policy and framework for their Information Security Program. Your new boss, the Chief Financial Officer, has asked you to draft an outline of a security policy and recommend an industry/sector neutral information security control framework for implementation. Your Corporate Information Security Policy should include which of the following?

Question

Quizplus · Accepted Answer

Roles and responsibilities are a critical component of any security policy, as they define who is responsible for what aspects of security.

Scenario: You Are the Newly Hired Chief Information Security Officer