Domain 5/Objective 5.3 Organizational Policies

A company wants to ensure that all changes to its IT infrastructure are documented and approved. Which policy supports this objective?

• Asset Management Policy

• Change Control Policy

• Separation of Duties Policy

• Credentialing Policy

An organization is implementing a policy to ensure that employees with access to sensitive data undergo regular background checks. Which policy is being enforced?

• Clean Desk Policy

• Nondisclosure Agreement

• Credentialing Policy

• Separation of Duties Policy

An organization is concerned about the potential leakage of sensitive information due to employees leaving printed documents on their desks. Which policy would address this concern?

• Least Privilege Policy

• Job Rotation Policy

• Clean Desk Policy

• Social Media Analysis Policy

A company is about to engage in a new business partnership, and both parties want to establish mutual expectations. Which legal document is most suitable for this purpose?

• Service Level Agreement

• Memorandum of Understanding

• Measurement Systems Analysis

• Business Partnership Agreement

A company is implementing measures to assess and manage risks associated with third-party vendors. Which category of policies should the organization focus on?

• Personnel Policies

• Training Policies

• Data Policies

• Third-Party Risk Management Policies

An organization wants to enhance user training by creating an interactive learning environment. Which training technique involves using simulated cyber-attacks to assess and improve the participants' security awareness?

• Capture-the-Flag Events

• Computer-Based Training

• Role-Based Training

• Gamification

An organization wants to ensure that only authorized personnel have access to specific resources based on their job roles. Which policy aligns with this objective?

• Asset Management Policy

• Change Control Policy

• Least Privilege Policy

• Credentialing Policy

An organization is implementing measures to ensure that confidential information shared with third parties is kept confidential. Which policy would address this concern?

• Data Governance Policy

• Nondisclosure Agreement Policy

• Credentialing Policy

• Separation of Duties Policy

A company is preparing to decommission outdated IT equipment and wants to establish guidelines for the secure disposal of hardware. Which policy should be implemented?

• Change Management Policy

• Data Classification Policy

• End-of-Life Policy

• Asset Management Policy

An organization is implementing a policy to categorize data based on sensitivity and importance. Which policy is being enforced?

• Data Classification Policy

• Data Governance Policy

• Data Retention Policy

• Nondisclosure Agreement