11.0 Security Governance Concepts

Standards

• Expected outcome or state of a task that has been performed in accordance with policies and procedures.

• A set of rules that must be followed at all times.

• A guideline that is optional and can be ignored if necessary.

• A method of evaluating employee performance based on personal opinions.

Workforce multiplier

• A tool or automation that increases employee productivity, enabling them to perform more tasks to the same standard per unit of time.

• A method for reducing the number of employees needed for a task.

• A strategy for increasing employee salaries to boost morale.

• A software that tracks employee attendance and hours worked.

Guidelines

• Strictly enforceable policies and standards for configuration items.

• Best practice recommendations and advice for configuration items where detailed, strictly enforceable policies and standards are impractical.

• A set of rules that must be followed without exception.

• General suggestions that can be ignored if necessary.

Version control

• The practice of ensuring that the assets that make up a project are closely managed when it comes time to make changes.

• A method for tracking changes in software development only.

• A system for managing project deadlines and schedules.

• A technique for optimizing code performance.

Dependencies

• Resources and other services that must be available and running for a service to start.

• A list of tasks that need to be completed before a project can begin.

• The amount of time required to complete a project.

• The budget allocated for a specific service or project.

Software Development Life Cycle (SDLC)

• A process of planning, analysis, design, implementation, and maintenance that governs software and systems development.

• A method for testing software after it has been developed.

• A framework for managing software licenses and compliance.

• A strategy for marketing software products to consumers.

Procedures

• Detailed instructions for completing a task in a way that complies with policies and standards.

• General guidelines that provide a framework for decision-making.

• A set of rules that govern the behavior of individuals in an organization.

• A summary of best practices for efficient task completion.

Technical debt

• Costs accrued by keeping an ineffective system or product in place, rather than replacing it with a better-engineered one.

• A financial term used to describe the cost of borrowing money.

• The amount of time required to complete a project due to poor planning.

• A strategy for reducing expenses in software development.

Stakeholders

• A person who has a business interest in the outcome of a project or is actively involved in its work.

• An individual who provides financial support without any involvement in the project.

• A team member who is responsible for executing tasks within the project.

• A consultant who offers advice but does not participate in the project.

Disaster Recovery

• A plan for managing daily operations of a business.

• A documented and resourced plan showing actions and responsibilities to be used in response to critical incidents.

• A strategy for increasing sales and marketing efforts.

• A method for training employees on new software.