(ISC)2 Certified in Cybersecurity Practice Exam

What encompasses the policies, roles, and processes for making security decisions in an organization?

1. Security Governance

2. Risk Management

3. Compliance Framework

4. Data Protection Strategy

The correct answer is: Security Governance

Security governance is the framework that encompasses the policies, roles, and processes for making security decisions within an organization. It provides the structure through which an organization's information security strategy is managed and directed. This includes defining the roles and responsibilities of various stakeholders, establishing security policies that align with organizational goals, and creating processes for security decision-making. Having a robust security governance framework is crucial for ensuring that security measures are not only effective but also aligned with the overall objectives of the organization. It sets the foundation for how security risks are managed, compliance with regulations is achieved, and resources are allocated to maintain a secure environment. While risk management focuses specifically on identifying, assessing, and mitigating risks, and a compliance framework centers on adhering to legal and regulatory requirements, security governance unifies these elements under a strategic umbrella. Similarly, a data protection strategy is more concentrated on safeguarding specific types of data rather than the broader governance structure that dictates how security is approached organization-wide.