Study. uk . com
  1. Home
  2. All questions
  3. Question 57

CISM study material · question 57 of 1000

A security policy is reviewed and found to name roles and set a control baseline, but staff say they do not know what conduct is expected of them or what happens if they fall short. Which required element is missing?

  1. A definition of the roles and responsibilities held by each party named in the policy, and the authority each of them carries
  2. A statement of the control baseline
  3. Rules for exceeding the control baseline
  4. Rules of behaviour with the minimum repercussions for non-compliance
Show the answer

Answer: D. Rules of behaviour with the minimum repercussions for non-compliance

NIST requires policy to address roles and responsibilities, a statement of the control baseline with rules for exceeding it, and rules of behaviour expected of users with the minimum repercussions for non-compliance.

Source: NIST SP 800-100 (NIST) — Sec. 2.2.5 Policy and Guidance

Challenge yourself on this topic → Study as cards