Background on CIS Controls, Standards, and Governance GCCC Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A technology startup is experiencing rapid growth and has just hired its first dedicated security officer. The CEO wants to establish a governance structure that can scale with the company. The security officer proposes using the CIS Controls as the basis for the security program. Which governance approach best supports scalability while maintaining alignment with business objectives?

   • AFocus only on technical controls and defer governance until the company is larger.
   • BOutsource governance to a managed security service provider to avoid internal overhead.
   • CImplement all CIS Controls immediately and document them in a static policy.
   • DDefine security roles and responsibilities, and use the CIS Controls to guide policy development and risk assessments as the company grows.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   How do Implementation Groups (IGs) guide organizations in prioritizing controls?

   • ABy providing a set of controls that are mandatory for all organizations regardless of size
   • BBy assigning each control to a specific department within the organization
   • CBy requiring organizations to implement all controls in a single phase to achieve full compliance
   • DBy grouping controls into three tiers based on the organization's risk profile and available resources
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security architect is comparing CIS Controls v7.1 and v8 to decide which to use for a new client. The client is a small law firm with no dedicated security staff. Which factor most strongly favors using CIS Controls v8?

   • Av8 is backward-compatible with v7.1, so the client can use both versions simultaneously.
   • Bv8 is the only version that supports cloud environments, while v7.1 is on-premises only.
   • Cv8 is organized into 18 controls with Implementation Groups, making it easier for a small firm to prioritize and implement the most important safeguards.
   • Dv8 includes more controls than v7.1, providing a more comprehensive security program.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A retail chain is implementing the CIS Controls and wants to ensure that its security policies are consistent with the controls. Which approach best integrates the CIS Controls into policy development?

   • AReview each CIS Control and update existing policies to reflect the required safeguards and responsibilities.
   • BUse the CIS Controls as a replacement for all existing security policies.
   • CAdopt policies from another organization that uses the CIS Controls, since they are best practices.
   • DCreate a single policy that lists all CIS Controls without detailing implementation responsibilities.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A global logistics company has operations in multiple countries, including regions with strict data protection laws. They have a mature security team and handle high-value cargo tracking data. They are implementing CIS Controls v8 and have completed IG1 and IG2. The board is now asking whether they should proceed to IG3. Which consideration is most important for this decision?

   • AWhether the company's competitors are implementing IG3, since competitive parity is the primary driver.
   • BWhether the company can afford to implement all IG3 safeguards, since cost is the only factor that matters.
   • CWhether the additional IG3 safeguards are necessary to address the specific risks and regulatory requirements in the regions where they operate.
   • DWhether the board can understand the technical details of IG3 safeguards, since governance approval requires technical literacy.
   Reveal Solution Discussion Select an answer first