(ISC)2 Certified in Cybersecurity Practice Exam

What is meant by Adequate Security?

1. Security measures that exceed regulatory requirements

2. Security that corresponds with the risk and potential harm

3. Minimal security measures for cost-saving

4. Overzealous security measures that hinder workflow

The correct answer is: Security that corresponds with the risk and potential harm

The concept of Adequate Security refers to having security measures that are appropriately aligned with the specific risks and potential harms faced by an organization. This means that the implemented security controls should effectively address and mitigate the identified threats, vulnerabilities, and risks, ensuring that the overall security posture is sufficient to protect assets and data without unnecessary excess. In this context, security measures should be proportionate to the level of risk. For example, a high-risk environment may require more robust safeguards, while a lower-risk environment may only need basic protections. This alignment helps organizations allocate their resources efficiently, ensuring that they invest in security measures that commensurate with the potential impact of a security incident. The other choices do not accurately capture the essence of Adequate Security. Choosing security measures that exceed regulatory requirements could result in unnecessary costs and resource allocation without guaranteeing better protection. Minimal security measures for cost-saving can leave organizations vulnerable, while excessive security can create operational and workflow challenges, hindering productivity. Thus, the focus on an appropriate and balanced approach to security is critical to achieving Adequate Security.