As Part of an Organization's Information Security Governance Process, a Chief

question 161

Multiple Choice

As part of an organization's information security governance process, a Chief Information Security Officer (CISO) is working with the compliance officer to update policies to include statements related to new regulatory and legal requirements. Which of the following should be done to BEST ensure all employees are appropriately aware of changes to the policies?

• A) Conduct a risk assessment based on the controls defined in the newly revised policies
• B) Require all employees to attend updated security awareness training and sign an acknowledgement
• C) Post the policies on the organization's intranet and provide copies of any revised policies to all active vendors
• D) Distribute revised copies of policies to employees and obtain a signed acknowledgement from them

---

Definitions:

Contribution Margin Ratio

The percentage of each sale that exceeds the variable costs and contributes to covering fixed costs and generating profit.

Traceable Fixed Expenses

Fixed costs that can be directly linked to a specific business segment or product.

Segment Margin

The amount of profit or loss generated by an individual segment of a business after deducting direct and traceable costs.

Net Operating Income

The income yielded by a company's primary activities, not including costs or earnings from activities outside its main operations.