Information Security Governance practice questions

Minimize security spending to maximize ROI.

Why wrong: Cost reduction may compromise necessary security controls.

Adopt a best-practice framework such as NIST CSF and implement all controls.

Why wrong: May not address specific business needs or risk tolerance.

Focus on regulatory compliance to ensure legal requirements are met.

Why wrong: Compliance is necessary but insufficient for full alignment with business objectives.

To manage day-to-day security operations.

Why wrong: Operational tasks are handled by security teams, not governance committees.

To implement security controls across the organization.

Why wrong: Implementation is the responsibility of operational teams.

To approve technical security solutions.

Why wrong: Technical approvals are typically delegated to technical boards.

Number of security alerts triaged per day.

Why wrong: Operational metric, not a business value indicator.

Time to patch critical vulnerabilities.

Why wrong: Technical metric, not directly showing business value.

Percentage of systems with endpoint protection installed.

Why wrong: Does not reflect business value or risk reduction.

Conduct a security awareness training for the target company's employees.

Why wrong: Necessary but not the first step; assessment should come first.

Align the target company's security policies with the acquirer's policies.

Why wrong: Premature without understanding the target's environment.

Implement the acquirer's security governance framework immediately.

Why wrong: Imposition without assessment can lead to failure.

Implement technical controls to enforce the policy.

Why wrong: Technical enforcement should follow communication, not precede it.

Conduct an audit to measure compliance.

Why wrong: Auditing should occur after the policy has been implemented and communicated.

Enforce disciplinary actions for non-compliance.

Why wrong: Enforcement without communication is unfair and ineffective.

Implement strict access controls and encryption for all data.

Why wrong: Technical controls alone do not address the innovation balance.

Adopt a 'security by design' approach for all new projects.

Why wrong: Important but may not provide the balance needed; too security-centric.

Create a separate innovation sandbox with limited data access.

Why wrong: May limit innovation scope and does not address governance balance.

Managing the day-to-day security operations.

Why wrong: Operational responsibility of security teams.

Implementing security controls and technologies.

Why wrong: Operational task delegated to management.

Developing detailed security policies and procedures.

Why wrong: Typically developed by security management.

Allow each business unit to define its own security policies.

Why wrong: Leads to inconsistency and gaps.

Implement a federated model where business units have complete autonomy.

Why wrong: Autonomy without central oversight undermines governance.

Mandate that all business units adopt the same security tools and processes.

Why wrong: May not fit all units and could cause operational friction.

The vendor's service level agreements (SLAs) for incident response times.

Why wrong: SLAs are operational but governance oversight is paramount.

The vendor's technical expertise and certifications.

Why wrong: Important but not the most critical governance issue.

The cost savings compared to in-house operations.

Why wrong: Cost is important but not the most critical governance consideration.

Intrusion detection system (IDS) configuration.

Why wrong: Operational tool, not a governance framework component.

Firewall rule set.

Why wrong: Technical control, not governance framework component.

Payment Card Industry Data Security Standard (PCI DSS) compliance report.

Why wrong: Compliance artifact, not a governance framework component.

Help desk manager.

Why wrong: Operational support role, not governance.

Network administrator.

Why wrong: Technical role, not part of governance structure.

Eliminate all information security risks.

Why wrong: Risk elimination is impossible; governance manages risk.

Maximize profitability through security investments.

Why wrong: Profit is a business goal, not governance objective.

Achieve compliance with all applicable regulations.

Why wrong: Compliance is a requirement, but not the primary objective of governance.

Segment the network to isolate production databases from developer workstations.

Why wrong: Network segmentation is a technical control; the governance gap remains.

Conduct security awareness training for all developers on password security.

Why wrong: Training is insufficient; the issue is lack of governance over privileged access.

Deploy endpoint protection and patch management for all workstations.

Why wrong: Technical controls address symptoms, not the governance gap.

Outsource the training to a third-party provider.

Why wrong: Outsourcing does not inherently improve compliance if content and enforcement are not improved.

Increase the frequency of reminder emails from monthly to weekly.

Why wrong: Reminders alone are unlikely to significantly improve compliance.

Implement a learning management system (LMS) to track completion.

Why wrong: Tracking does not address the lack of relevance or enforcement.

Review the cloud provider's SOC 2 report for compliance with relevant regulations.

Why wrong: Compliance is important but not the most important for risk alignment.

Negotiate contract terms including data protection clauses with the cloud provider.

Why wrong: Contractual protections are important but should be informed by risk assessment.

Develop a detailed access control policy specifically for the cloud ERP system.

Why wrong: Access control is part of security, but not the primary step for risk alignment.

Percentage of systems compliant with security baseline.

Why wrong: Compliance does not equal effectiveness; controls may still be inadequate.

Number of security incidents reported per month.

Why wrong: This is an operational metric that does not directly indicate program effectiveness.

Mean time to detect (MTTD) security events.

Why wrong: This is a technical metric, not a strategic one for the board.

The latest cybersecurity threats reported in the industry.

Why wrong: Threats inform but should not be the primary driver without business context.

Past security incidents that caused significant financial loss.

Why wrong: Past incidents are lessons learned but not the primary driver for a forward-looking strategy.

The security budget allocated for the fiscal year.

Why wrong: Budget constraints may influence implementation but should not drive selection.

Provide additional security awareness training focused on policy requirements.

Why wrong: Training is helpful but may not be sufficient if policies are not aligned with business processes.

Escalate non-compliance to senior management for disciplinary action.

Why wrong: Disciplinary action may create resistance and does not address root causes.

Increase the frequency of automated policy compliance checks.

Why wrong: Monitoring alone does not improve compliance; it only detects non-compliance.

Define the organization's risk appetite and risk tolerance levels.

Why wrong: Risk appetite is defined by the board, often informed by initial risk understanding.

Implement security controls based on industry best practices.

Why wrong: Controls should be risk-driven, not based solely on best practices.

Select a risk management framework such as ISO 31000 or NIST RMF.

Why wrong: Framework selection occurs after understanding the organization's needs.

Perform vulnerability assessments on critical systems.

Why wrong: Technical assessments are not a governance committee responsibility.

Set the organization's risk appetite.

Why wrong: Risk appetite is set by the board of directors.

Conduct daily monitoring of security events.

Why wrong: This is an operational task, not governance.