CISM Certification Domain 1: Information Security Governance Video Boot Camp 2019 - Data security frameworks

The video tutorial discusses the importance of using industry standards and baselines to determine security controls. It explains the concepts of scoping and tailoring, which help in deciding which parts of a standard to implement and how to customize them for stronger security, such as using AES 256 encryption. The tutorial also covers the process of classification, certification, and accreditation, emphasizing the need for systems to meet security requirements and for data owners to accept residual risks before systems go into production.

Which of the following is NOT mentioned as a framework in the video?

• ISO 27000 series

• PCI DSS

• NIST

• ITIL

What is the primary purpose of scoping in the context of standards?

• To determine the budget for security measures

• To decide which parts of a standard to implement

• To evaluate the effectiveness of a standard

• To compare different standards

How does tailoring differ from scoping?

• Tailoring is about determining the scope of a standard

• Tailoring is used to compare different standards

• Tailoring is about setting a budget for security

• Tailoring involves choosing specific implementations like encryption

What must happen before a system is put into production according to the video?

• The system must be approved by the IT department

• The system must be tested for bugs

• The system must be certified and accredited

• The system must be reviewed by external auditors

What does accreditation involve in the context of system security?

• Accepting the certification and residual risks

• Training staff on security protocols

• Conducting a final security audit

• Implementing additional security measures