Information Security Governance practice questions

Gap analysis

Why it fails: Gap analysis occurs before drafting.

Training

Why it fails: Training occurs after approval.

Stakeholder consultation

Why it fails: Consultation typically occurs during drafting or before.

HIPAA (Health Insurance Portability and Accountability Act)

Why it fails: HIPAA governs protected health information held by healthcare providers, insurers and clearinghouses, so it fails to bind a financial services firm's core customer data. It is tempting because banks may administer health savings accounts or process medical claims, where HIPAA would then apply.

GDPR (General Data Protection Regulation)

Why it fails: GDPR governs processing of EU residents' personal data, binding a US financial firm only where it offers goods or monitors individuals in the EU. A purely domestic US operation falls under GLBA, SOX and PCI DSS instead.

Level 3: Defined

Why it fails: Defined has standardized processes.

Level 2: Repeatable

Why it fails: Repeatable has basic process discipline.

Level 5: Optimizing

Why it fails: Optimizing focuses on continuous improvement.

Stakeholder consultation

Why it fails: Consultation occurs before drafting.

Training and awareness

Why it fails: Training occurs after approval.

Approval by management

Why it fails: Approval comes after legal review.

Phishing simulation click rate

Why it fails: Awareness metric, not board-level.

Average patch deployment time

Why it fails: Operational metric, not strategic.

Number of firewall rules

Why it fails: Too technical for board.

Decentralized with business unit CISO

Why it fails: No business unit CISO mentioned.

Outsourced security management

Why it fails: No outsourcing described.

Centralized with CISO reporting to CEO

Why it fails: CISO does not report to CEO here.

Legal review

Why it fails: Legal review comes after drafting.

Drafting the policy

Why it fails: Drafting occurs after gap analysis.

Stakeholder consultation

Why it fails: Consultation follows gap analysis.

To reduce the cost of security operations

Why it fails: Cost reduction is a potential benefit but not the primary reason for alignment.

To comply with regulatory requirements

Why it fails: Compliance is a driver but not the primary reason for alignment.

To ensure security initiatives receive adequate funding

Why it fails: Adequate funding may result from alignment but is not the primary reason.

Level 5 (Optimizing)

Why it fails: Level 5 focuses on continuous process improvement.

Level 2 (Repeatable)

Why it fails: Level 2 focuses on basic project management and repeatability.

Level 3 (Defined)

Why it fails: Level 3 standardizes processes across the organization.

Procedure

Why it fails: Procedures are step-by-step instructions, not policy.

Guideline

Why it fails: Guidelines are recommendations, not mandatory.

Enterprise security policy

Why it fails: Enterprise policy is too broad; remote access is a domain-specific topic.

Conducting daily security operations

Why it fails: Conducting daily security operations is an execution task performed by security staff, not a governance function; boards provide oversight and strategic direction. It tempts because boards are accountable for security outcomes, but that accountability is discharged through monitoring and reporting, not hands-on administration.

Developing detailed security policies

Why it fails: Drafting detailed security policies is management's execution responsibility, delegated to the CISO and security function; the board sets direction and oversees risk appetite. It tempts because policy approval appears governance-related, but boards approve overarching policy frameworks, not their operational content.

Approving specific security technologies

Why it fails: Selecting specific security technologies is an operational decision belonging to management and architecture teams; the board lacks the technical context and should not endorse individual products. It tempts because technology investment requires funding approval, yet boards approve budgets and risk tolerance, not vendor or product choices.

Legal review

Why it fails: Legal review validates wording against statutory and regulatory obligations, but it occurs after a draft exists and the need is defined. Reviewing a policy before its scope and business driver are established wastes effort. Legal review is correct later, during validation of the drafted policy.

Stakeholder consultation

Why it fails: Consulting stakeholders shapes content and builds buy-in, but it follows the initial trigger: identifying the business need and securing management direction. Consultation is correct during policy formulation, after the mandate exists, so it is tempting as an early collaborative activity.

Drafting the policy

Why it fails: Drafting produces the policy text, but it presupposes an approved mandate and scope. Without first identifying the business need and obtaining management direction, any draft lacks authority and will be rewritten. Drafting is the correct step once the need and sponsorship are established, which is why it appears plausible here.

Publicizing the exception to all employees

Why it fails: Publicizing is not necessary and may cause confusion.

Automatic expiration of the exception after a defined period

Why it fails: Exceptions should have a review date but automatic expiration may cause issues.

Time since last security audit

Why it fails: Not a direct measure of culture; audit frequency is a governance process.

Number of security incidents reported to management

Why it fails: High reporting can be good or bad; not specific to culture.

Conduct a comprehensive risk assessment of all information assets.

Why it fails: Risk assessment is a critical component of risk management, but it is not the first step in establishing governance. Governance provides the structure and oversight for risk management. Without roles, responsibilities, and accountability defined, risk assessment results may not be acted upon effectively. Governance framework must precede detailed risk activities.

Deploy a security information and event management (SIEM) system.

Why it fails: A SIEM is a technical tool for monitoring and incident detection. It does not establish governance. Governance is about direction, oversight, and accountability, not technology deployment. Implementing technology before governance can lead to misalignment with business objectives and ineffective use of resources. The board seeks assurance of alignment, which requires governance structure first.

Implement a security awareness training program for all employees.

Why it fails: While awareness training is important, it is an operational control that should follow governance establishment. Without defined roles and responsibilities, training may not be targeted or effective. The board's directive is about governance framework, which requires structural elements first. Training is a downstream activity that depends on clear accountability and policy.

The total cost of ownership (TCO) of the security solution over five years.

Why it fails: TCO is an important financial consideration, but it is not a justification for the investment by itself. A business case must show value, such as risk reduction or compliance, not just cost. TCO alone does not demonstrate business value; it is a supporting detail. The board needs to see the benefits relative to the costs, not just the costs.

The number of security incidents prevented in the last year.

Why it fails: Historical incident counts can provide context, but they are not a forward-looking justification for a new investment. The business case should focus on future risk reduction and business alignment. Past incidents may not reflect future threats or the specific value of the proposed solution. This factor is less important than risk reduction and compliance alignment.

The technical specifications of the proposed security solution.

Why it fails: Technical specifications are important for implementation but are not the primary justification for a business case. The board and business stakeholders focus on business value, risk reduction, and compliance. While technical details may be included in an appendix, they do not demonstrate business value and are therefore less important for the business case.

Reviewing and approving security policies and standards.

Why it fails: Policy approval is typically a responsibility of executive management or the CISO, not the steering committee. The steering committee's primary role is strategic oversight and prioritization. While it may review policies, its main focus is ensuring alignment with business objectives and managing risk at a strategic level. Policy approval is more operational and should be delegated.

Managing the daily operations of the security operations center (SOC).

Why it fails: Managing the SOC is an operational responsibility, typically handled by the SOC manager or security operations team. The steering committee focuses on strategic governance, not operational management. Involving the committee in daily operations would be inefficient and would detract from its primary purpose of providing oversight and strategic direction. Operational tasks should be delegated to management.

Conducting technical vulnerability assessments and penetration tests.

Why it fails: Technical assessments are operational activities performed by security engineers or specialized teams. The steering committee is a strategic oversight body and should not be involved in technical execution. Its role is to ensure that such activities are aligned with business risk priorities and that resources are allocated appropriately. Direct involvement in technical testing would distract from its governance responsibilities.

Performing technical vulnerability assessments

Why it fails: Vulnerability assessment is hands-on technical work performed by security engineers or analysts, sitting far below governance. The board's role is directing and overseeing the security programme, not executing scans. Technical testing would be the right answer if the question asked who performs operational security assessments.

Approving specific security tools and technologies

Why it fails: Tool selection is a management execution task delegated to security leadership, not board-level governance. The board sets risk appetite and strategy, then receives assurance. Approving specific products would be the correct action for a CISO or security steering committee, not directors.

Conducting daily security monitoring activities

Why it fails: Daily monitoring is an operational control executed by the security operations centre, not a governance function. The board provides oversight and strategic direction instead. Monitoring would be correct if the question asked which activity belongs to SOC analysts or security administrators.

Lower cost due to elimination of central security team

Why it fails: Lower cost is a potential benefit, not a challenge, so it does not answer what the model makes difficult. Decentralised governance typically raises duplication and inconsistent controls across units. The option is tempting because cost reduction is a genuine argument for decentralisation, but the question asks for a drawback.

Rapid decision-making due to fewer layers

Why it fails: Rapid decision-making is a benefit of decentralisation, not a challenge, so it cannot answer a question asking for a key challenge. It is tempting because reduced approval layers genuinely speed up security decisions, which is why decentralised governance suits agile business units needing fast, local responses.

Increased central control and uniformity

Why it fails: Increased central control and uniformity describes centralised governance, the opposite of the stem's decentralised model. Decentralisation's challenge is inconsistent standards and duplicated effort across business units. The option is tempting because uniformity sounds like a governance goal, but it is what decentralisation sacrifices, not what it creates.

Ease of implementation

Why it fails: Ease of implementation reflects effort and delivery speed, not the magnitude of risk exposure to the business, so it cannot determine priority. It is tempting because quick wins build momentum, and would be correct when sequencing already-approved initiatives within a release, rather than deciding which risks to address first.

Availability of new technology

Why it fails: New technology availability is a supply-side consideration; it does not indicate which assets or threats most endanger business objectives, so it cannot drive prioritisation. It is tempting because emerging tools can address previously unmitigable risks, and would be correct when selecting the control to implement for an already-prioritised risk.

Cost of the initiative

Why it fails: Cost determines affordability and sequencing within a budget, but it does not express which risks threaten the organisation's objectives, so it cannot rank initiatives by urgency. Cost is genuinely relevant when comparing vendor quotes for an already-prioritised initiative, or when a fixed budget forces trade-offs among equally ranked risks.