IT Governance and Cybersecurity Flashcards

A financial services company is implementing an IT governance framework to ensure alignment with business objectives and manage risk effectively. Which of the following frameworks is primarily focused on the governance and management of enterprise IT, providing a comprehensive approach to aligning IT with business goals?

Answer: COBIT (Control Objectives for Information and Related Technologies)

COBIT is a framework specifically created by ISACA for the governance and management of enterprise IT. It provides a comprehensive set of controls and objectives to help organizations align their IT strategies with their overall business goals, manage risks, and ensure compliance. While ISO 27001 focuses on information security management, NIST CSF provides a high-level framework for managing cybersecurity risk, and ITIL focuses on IT service management, COBIT is the most encompassing framework for overall IT governance.

A healthcare organization is working to improve its cybersecurity posture. As part of this initiative, they are adopting the NIST Cybersecurity Framework. Which of the following is NOT one of the five core functions of the NIST Cybersecurity Framework?

Answer: Mitigate

The five core functions of the NIST Cybersecurity Framework are Identify, Protect, Detect, Respond, and Recover. 'Mitigate' is a concept that is part of the overall risk management process and is a key activity within the 'Respond' function, but it is not one of the five primary core functions itself.

A technology startup is establishing its Information Security Management System (ISMS) to demonstrate its commitment to data protection to potential clients. Which international standard provides the requirements for an ISMS and is often used for certification?

Answer: ISO/IEC 27001

ISO/IEC 27001 is the leading international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). Organizations can get certified against this standard to prove to stakeholders that they manage information security according to international best practices.

As part of a GRC initiative, an organization is defining clear roles and responsibilities for cybersecurity. According to IT governance best practices, who holds the ultimate responsibility for an organization's information security?

Answer: The Board of Directors and Senior Management

Ultimate responsibility for information security and IT governance lies with the Board of Directors and senior management. They are responsible for setting the organization's risk tolerance, providing oversight, and ensuring that resources are allocated to manage security risks effectively. The CISO and IT department are responsible for implementing and managing the security program, but accountability rests at the highest level of the organization.

A retail company recently suffered a data breach that exposed customer information. In the aftermath, the incident response team is focused on restoring systems and data from backups and implementing long-term improvements to prevent a recurrence. According to the NIST Cybersecurity Framework, which core function are they primarily executing?

Answer: Recover

The 'Recover' function of the NIST Cybersecurity Framework involves developing and implementing the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event. This includes restoring systems from backups and making improvements to prevent future incidents.

Which of the following is a primary objective of establishing a formal IT Governance framework within an organization?

Answer: To align IT strategy with business strategy and objectives.

The fundamental purpose of IT governance is to ensure that IT investments and activities are aligned with and support the overall business strategy and objectives. It provides a structure for decision-making and accountability to ensure that IT delivers value to the business, manages risks, and optimizes resources.