Defining an Information Security Governance Program ACCISO Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is NOT one of the five key outcomes of information security governance?

   • ARisk management
   • BValue delivery
   • CTechnology acquisition
   • DResource management
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A hospital is implementing a new patient portal that will allow patients to access their medical records online. The CISO must ensure that the security governance program supports this initiative while complying with healthcare regulations. Which stakeholder engagement strategy is most effective?

   • ADelay the project until all stakeholders agree on every detail
   • BEngage only the legal team to ensure compliance
   • CForm a cross-functional team including clinical, legal, IT, and security stakeholders to define requirements
   • DHave the security team define all requirements independently
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A consulting firm is updating its security governance documentation. The CISO has created a new security policy but has not yet updated the supporting standards and procedures. Employees are confused about how to comply with the policy. What is the most likely consequence of this gap?

   • AThe policy will be considered a standard
   • BThe policy will be ignored by all employees
   • CInconsistent implementation of the policy across the organization
   • DThe policy will be automatically enforced by technical controls
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An organization is updating its governance documentation. Which document would be most appropriate to define the security roles and responsibilities for a new cloud migration project?

   • AThe incident response plan.
   • BThe security awareness training schedule.
   • CThe overall information security policy.
   • DA RACI matrix specific to the cloud migration project.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A healthcare organization's board wants to evaluate whether its information security governance program is effective. The CISO proposes a balanced scorecard that tracks security incidents, compliance with regulations, and the percentage of IT projects that meet security requirements. Which governance outcome is the CISO primarily trying to demonstrate?

   • ARisk management integration
   • BResource management
   • CPerformance measurement and value delivery
   • DStrategic alignment
   Reveal Solution Discussion Select an answer first