A newly appointed CISO at a non-profit organization is asked to 'establish security governance.' The organization has never had a formal security program. Which first step best defines the purpose of security governance?

Hire a penetration testing firm to assess the current security posture.

Define the organization's risk appetite and establish a board-approved security policy.

Purchase and deploy a next-generation firewall to protect the network perimeter.

Create a security awareness training video for all employees.

Which statement best defines information security governance?

The set of policies and procedures that dictate how employees handle data on a daily basis

The process of implementing specific security controls and technologies to protect information assets

The framework by which an organization directs and controls its information security activities to align with business objectives and manage risk

The technical architecture that secures an organization's network and systems

A CISO is designing the governance reporting for the board. The board is concerned about both the level of risk and the performance of the security program. The CISO has limited reporting time and must choose a set of metrics that provides a balanced view. Which set is most balanced?

Only KPIs, such as the number of security awareness training sessions delivered.

A single metric that combines all risk and performance data into one number.

A mix of KRIs (e.g., percentage of critical systems with high-risk vulnerabilities) and KPIs (e.g., percentage of security projects completed on schedule).

Only KRIs, such as the number of open risk findings.

EC-CouncilCertified Chief Information Security Officer

Domain 1Objective 2

Defining an Information Security Governance Program CCISO Practice Questions (Page 11)

Part of the Governance, Risk, and Compliance domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

8concepts

Questions 51–53

51application · medium
A newly appointed CISO at a non-profit organization is asked to 'establish security governance.' The organization has never had a formal security program. Which first step best defines the purpose of security governance?
Select an answer first
52foundation · easy
Which statement best defines information security governance?
Select an answer first
53expert · hard
A CISO is designing the governance reporting for the board. The board is concerned about both the level of risk and the performance of the security program. The CISO has limited reporting time and must choose a set of metrics that provides a balanced view. Which set is most balanced?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Defining an Information Security Governance Program CCISO Practice Questions (Page 11)

Questions 51–53

A newly appointed CISO at a non-profit organization is asked to 'establish security governance.' The organization has never had a formal security program. Which first step best defines the purpose of security governance?

Which statement best defines information security governance?

A CISO is designing the governance reporting for the board. The board is concerned about both the level of risk and the performance of the security program. The CISO has limited reporting time and must choose a set of metrics that provides a balanced view. Which set is most balanced?

Keep studying — Governance, Risk, and Compliance