An organization that outsourced its payroll processing performed an independent assessment of the security controls of the third party, per policy requirements. Which of the following is the MOST useful requirement to include in the contract?

• A.Right to audit
• B.Nondisclosure agreement
• C.Proper firewall implementation
• D.Dedicated security manager for monitoring compliance

Comment: *

Name: *

Email: *

Verification: *

An organization plans to contract with an outside service provider to host its corporate web site. The MOST important concern for the information security manager is to ensure that:

• A.an audit of the service provider uncovers no significant weakness.
• B.the contract includes a nondisclosure agreement (NDA) to protect the organization's intellectual property.
• C.the contract should mandate that the service provider will comply with security policies.
• D.the third-party service provider conducts regular penetration testing.

Comment: *

Name: *

Email: *

Verification: *

Which of the following messages would be MOST effective in obtaining senior management's commitment to information security management?

• A.Effective security eliminates risk to the business
• B.Adopt a recognized framework with metrics
• C.Security is a business product and not a process
• D.Security supports and protects the business

Comment: *

Name: *

Email: *

Verification: *

Security awareness training should be provided to new employees:

• A.on an as-needed basis.
• B.during system user training.
• C.before they have access to data.
• D.along with department staff.

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the BEST approach to identify noncompliance issues with legal, regulatory, and contractual requirements?

• A.Risk assessment
• B.Business impact analysis (BIA)
• C.Vulnerability assessment
• D.Gap analysis

Comment: *

Name: *

Email: *

Verification: *