5.1 Summarize elements of effective security governance

This set of flashcards covers key concepts and definitions related to security governance, compliance, and associated policies.

Policies, standards, and procedures are three key components that form the foundation of an organization's __________ program.

security

Organizational policies provide a framework for operations, decision-making, and behaviors, establishing the rules for a compliant and __________ corporate culture.

ethical

The primary goal of an Acceptable Use Policy (AUP) is to ensure that users do not engage in activities that could harm the organization or its __________.

resources

The __________ outlines the processes to be followed after a security breach or cyberattack occurs.

Incident Response policy

Change management policies outline how changes to IT systems and software are __________, reviewed, approved, and implemented.

requested

____________ describe recommendations that steer actions in a particular job role or department.

Guidelines

Regular review of guidelines is important to ensure they remain __________ and relevant.

practical

Standards define the expected __________ of a task, such as a particular configuration state for a server.

outcome

____________ standards ensure that only authorized individuals can access the systems and data they need for their jobs.

Access control

Physical security standards protect data centers, computer rooms, and hardware, ensuring the safety of the __________ environment.

IT

____________ protects data from unauthorized access and is vital for securing data both at rest and in transit.

Encryption

____________ roles in data governance include owner, controller, processor, and custodian.

Security governance

The __________ provides California residents the right to know what personal information businesses collect about them.

California Consumer Privacy Act (CCPA)

Governance boards oversee the implementation of security controls and work closely with risk management teams to ensure compliance with relevant __________ and regulations.

laws

The __________ mandates the implementation of risk assessments, internal controls, and audit procedures.

Sarbanes-Oxley Act (SOX)