Which description best defines cybersecurity governance?
Answer
A framework of policies, processes, and structures for directing and controlling cybersecurity activities
Explanation
### Why this is right
Governance describes how an organization directs and controls security work through structures, policies, and processes. It links security activity to business objectives and establishes how threats are managed.
### The concept
A technical control, such as filtering software, can support governance but is not governance by itself. Governance also addresses who makes decisions, who is accountable, and how progress is reviewed. Because risks and operations change, governance requires ongoing attention.
### The other options
- **B. A software tool that blocks every cyberattack**: Software is a possible control, but no tool can guarantee that every attack is blocked.
- **C. A one-time technical review of network devices**: A review can contribute to assessment, but governance is broader and ongoing.
- **D. A list of employee preferences about security**: Preferences do not establish organizational direction or accountability.
### Terms
- **Cybersecurity governance**: The organizational framework for directing and controlling cybersecurity activities.
### Remember
Governance sets direction and accountability; individual technologies carry out particular controls.
Related Questions
- Outsourcing payment processing to a third-party vendor completely transfers all regulatory compliance and data protection responsibilities away from the hiring organization.(intermediate)
- In an incident management exercise divided into discovery, investigation, response, and recovery, the phase focused on analyzing logs, alerts, and evidence to examine unauthorized activity is called _____.(basic)
- The recovery and compliance review phase can include a mock audit, ongoing monitoring, staff training, and improvements informed by the incident.(basic)
- A staff member accesses the billing system from an unprotected personal laptop, and suspicious activity alerts appear. Which response area is most directly implicated by this new information?(intermediate)
- During a tabletop incident response exercise involving potential payment card data compromise, which activity is the primary focus of the Discovery phase?(advanced)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free