As Part of an Organization's Information Security Governance Process, a Chief

question 161

Multiple Choice

As part of an organization's information security governance process, a Chief Information Security Officer (CISO) is working with the compliance officer to update policies to include statements related to new regulatory and legal requirements. Which of the following should be done to BEST ensure all employees are appropriately aware of changes to the policies?

• A) Conduct a risk assessment based on the controls defined in the newly revised policies
• B) Require all employees to attend updated security awareness training and sign an acknowledgement
• C) Post the policies on the organization's intranet and provide copies of any revised policies to all active vendors
• D) Distribute revised copies of policies to employees and obtain a signed acknowledgement from them

---

Definitions:

Specific Time

A clearly defined or precise moment or period on a timeline.

Customized Approach

Tailoring strategies, products, services, or policies to meet the specific needs or preferences of an individual or group.

Task Inventories

Comprehensive lists or databases of all the tasks performed within a particular job or organization, used for job analysis, training, and performance evaluation.

Technological Duties

Responsibilities or tasks that involve working with, managing, or developing technology and technological systems in various industries.