Share CBS 700 Chapter 2
Save to Folder
Which body is primarily responsible for security governance in an organisation?
The board and executive leadership
Security management and security governance refer to the same level of organisational activity.
Governance (board level) sets strategy. Management (CISO/senior managers) translates strategy into plans. Operations (IT/security teams) implements controls.
According to ITU-T X.1054, security governance is best defined as:
The system by which an organisation's information security activities are directed and controlled
What is the primary responsibility of the CISO?
Leading the security programme and owning security strategy
Describe ONE key difference between the role of the CRO and the role of the CISO.
CRO manages enterprise-wide risk across all business functions;The CISO focuses specifically on the information security programme and strategy
Mention any typical component of a strategic security plan?
A strategic security plan covers mission/vision, risk profile, current/target state, roadmap, and success metrics — all strategic
A CISO presents this to the board: "We applied 312 patches and updated firewall rules 47 times." What is the main governance problem
It uses technical metrics without communicating risk status, business impact, or compliance posture
In the Zachman framework applied to security, which dimension addresses "Who has access to what?"
Who (People)
What makes SABSA different from a purely technology-led approach to security architecture?
SABSA is risk-driven and starts from business requirements, ensuring security architecture is not a technical afterthought.
Security architecture is primarily about designing firewalls and technical network infrastructure.
Security architecture encompasses people, processes, and technology. It covers governance, data classification, access management, and cultural factors
Which level of the security policy hierarchy contains step-by-step instructions for handling a phishing email report?
Standard operating procedure (Level 4)
An Acceptable Use Policy (AUP) sits at which level of the security policy hierarchy?
Level 2 — Topic-specific policy
Once a security policy is approved, it does not need to be reviewed unless a major security incident occurs
Policies must be reviewed regularly as the threat landscape, regulations, business environment, and technology change
List any of the elements that a well-crafted Acceptable Use Policy should cover.
(1) permitted uses of organisational systems; (2) prohibited uses of systems; (3) internet and email usage rules; (4) data handling requirements; (5) consequenc
A CRO wants to accept a cybersecurity risk to reduce costs. The CISO disagrees. Who has ultimate authority over this decision?
The board — risk tolerance is a governance-level decision
Give any reason why security strategy must be aligned with business strategy rather than developed independently.
(1) Security must enable the business, 2) Resource allocation requires business context, (3) Risk tolerance is a business decision, (4) Compliance obligations
