Assessing Corporate Cybersecurityintermediate
Arrange the governance elements from higher-level direction toward operational checking.
Answer
Business mission and strategy, Cybersecurity strategy and policies, Cybersecurity standards, Operational requirements, design, and procedures, Testing, evaluation, and compliance review
Explanation
### The order
1. **Business mission and strategy**: these establish the organizational direction that security should support.
2. **Cybersecurity strategy and policies**: these translate business and risk direction into security expectations.
3. **Cybersecurity standards**: these state measurable outcomes required by policy.
4. **Operational requirements, design, and procedures**: these put the outcomes into practice.
5. **Testing, evaluation, and compliance review**: these check whether implementation meets the required outcomes.
### The concept
The hierarchy links strategic intent to operational evidence. It is not enough to publish direction; organizations also need implementation and checking. The source emphasizes direct traceability across the steps so that requirements can be managed and audited.
### Terms
- **Compliance review**: an examination of whether applicable requirements are being met.
- **Traceability**: the ability to follow requirements through linked governance and operational documents.
### Remember
Direction precedes standards, standards precede implementation, and implementation precedes verification.
Related Questions
- Outsourcing payment processing to a third-party vendor completely transfers all regulatory compliance and data protection responsibilities away from the hiring organization.(intermediate)
- In an incident management exercise divided into discovery, investigation, response, and recovery, the phase focused on analyzing logs, alerts, and evidence to examine unauthorized activity is called _____.(basic)
- The recovery and compliance review phase can include a mock audit, ongoing monitoring, staff training, and improvements informed by the incident.(basic)
- A staff member accesses the billing system from an unprotected personal laptop, and suspicious activity alerts appear. Which response area is most directly implicated by this new information?(intermediate)
- During a tabletop incident response exercise involving potential payment card data compromise, which activity is the primary focus of the Discovery phase?(advanced)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free