Information Security Management Program ACCISO Practice Questions (Page 11)

Questions 51–52

1. 51application · medium

   A technology startup is growing rapidly and needs to establish an Information Security Management Program. The CEO wants the program to support the company's agile development culture while still providing adequate governance. The company has no formal security policies yet. Which first step best aligns the ISMP with the organization's strategy and culture?

   • ADevelop a concise security policy that states core principles and delegate detailed standards and procedures to individual teams.
   • BWait until the company is larger and has more resources before establishing a formal ISMP.
   • CCreate a comprehensive set of detailed policies and procedures upfront to ensure complete coverage.
   • DAdopt a security framework like ISO 27001 and implement every control immediately.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A technology company's ISMP includes a security awareness program. The program has been running for a year, but the number of phishing incidents has not decreased. The CISO suspects the training is not effective. Which approach would best diagnose and improve the program?

   • AConduct a survey to assess employee knowledge and attitudes toward security
   • BReplace the training vendor with a different one
   • CMake the training mandatory for all employees
   • DIncrease the frequency of phishing simulations to reinforce the message
   Reveal Solution Discussion Select an answer first