CISM Certification Domain 1: Information Security Governance Video Boot Camp 2019 - Data security frameworks

The video tutorial discusses the importance of using industry standards and baselines to determine security controls. It explains the concepts of scoping and tailoring to customize these controls for specific organizational needs. The tutorial also covers the processes of classification and accreditation, emphasizing the need for certification and acceptance of residual risks before system deployment.

Which of the following is NOT a framework mentioned for determining controls in an organization?

• ITIL

• NIST

• ISO 27000 series

• PCI DSS

What is the primary purpose of scoping in the context of using a standard?

• To select the strongest encryption method

• To decide which parts of a standard to apply

• To determine the budget for implementing controls

• To ensure compliance with all industry standards

How does tailoring differ from scoping?

• Tailoring involves choosing specific implementations like encryption

• Tailoring is about determining the budget

• Tailoring is only applicable to data in motion

• Tailoring is a mandatory process for all standards

What does accreditation involve in the context of system security?

• Determining the scope of a standard

• Accepting certification and residual risks

• Ensuring compliance with all regulations

• Choosing the best encryption method

What must be done if a data owner refuses to accept the certification?

• The system must be put into production immediately

• The concerns must be addressed to obtain accreditation

• The certification process must be restarted

• The data owner must be replaced