The newly appointed CISO of an organization is reviewing the IT security strategic plan. Which of the following is the MOST important component of the strategic plan?

• A.There is integration between IT security and business staffing.
• B.The plan requires return on investment for all security projects.
• C.There is an auditing methodology in place.
• D.There is a clear definition of the IT security mission and vision.

Comment: *

Name: *

Email: *

Verification: *

You are just hired as the new CISO and are being briefed on all the Information Security projects that your section has on going. You discover that most projects are behind schedule and over budget. Using the best business practices for project management you determine that the project correctly aligns with the company goals and the scope of the project is correct.
What is the NEXT step?

• A.Verify budget
• B.Verify constraints
• C.Review time schedules
• D.Verify resources

Comment: *

Name: *

Email: *

Verification: *

Risk that remains after risk mitigation is known as_____________.

• A.Non-tolerated risk
• B.Accepted risk
• C.Residual risk
• D.Persistent risk

Comment: *

Name: *

Email: *

Verification: *

Which of the following is considered to be an IT governance framework and a supporting
toolset that allows for managers to bridge the gap between control requirements, technical issues, and business risks?

• A.Information Technology Infrastructure Library (ITIL)
• B.Payment Card Industry (PCI)
• C.Control Objective for Information Technology (COBIT)
• D.Committee of Sponsoring Organizations (COSO)

Comment: *

Name: *

Email: *

Verification: *

The process for management approval of the security certification process which states the risks and mitigation of such risks of a given IT system is called

• A.Alignment with business practices and goals.
• B.Security system analysis
• C.Security accreditation
• D.Security certification

Comment: *

Name: *

Email: *

Verification: *