* Strong Security Governance Requires Well-Defined Policies:
* Cybersecurity governance is built upon clear, documented, and enforceable security policies that outline expectations, roles, responsibilities, and processes.
* Policies define acceptable behaviors, security controls, incident response, and compliance requirements.
* IIA Standard 2110 - Governance: Requires organizations to establish effective IT security governance, including policies that address cybersecurity risks.
* IIA GTAG (Global Technology Audit Guide) on Information Security Governance:
* Recommends that clear policies should guide security controls, user access, and incident response to address cybersecurity threats.
* A. Inventory of information assets (Incorrect)
* While identifying critical information assets is essential for risk management, it does not constitute security governance on its own.
* Asset inventories support governance but must be reinforced by policies that define how data should be protected.
* B. Limited sharing of data files with external parties (Incorrect)
* Restricting data sharing is a control measure, not a governance principle.
* Policies define when, how, and under what conditions data can be shared securely.
* C. Vulnerability assessment (Incorrect)
* Assessments help identify security gaps but do not establish governance.
* Effective governance ensures that vulnerabilities are identified, prioritized, and remediated in accordance with policies.
Explanation of Answer Choice D (Correct Answer):Explanation of Incorrect Answers:Conclusion:To ensure strong security governance, organizations must have clearly defined security policies (Option D) as a foundation for managing cybersecurity threats.
IIA References:
* IIA Standard 2110 - Governance
* IIA GTAG - Information Security Governance