ISACA Certified Information Systems Auditor (CISA) ExamDomain 2: Governance and Management of ITMedium
A CISA is reviewing an organization's information security policy. The policy states that 'all critical data must be encrypted in transit.' However, the policy does not specify the encryption algorithms, key management procedures, or minimum acceptable strength. What is the MOST significant weakness of this policy statement?
- AIt does not explicitly define what constitutes 'critical data'.
- BIt may lead to higher costs if staff select overly complex encryption methods.
- CIt lacks enforceability and consistent implementation across the organization.
- DIt creates an unnecessary burden on IT staff to choose appropriate solutions.
Show answer & explanationAnswer & explanation
Correct answer: C. It lacks enforceability and consistent implementation across the organization.
For a policy to be effective, it must be enforceable and lead to consistent implementation. By omitting specific technical details like algorithms and key management, the policy becomes open to interpretation, making it difficult to enforce consistently and ensure adequate security measures are actually in place.
Why the other options are wrong
- A. While defining 'critical data' is important for scope, the immediate weakness of the given statement is the lack of specificity for the 'how' of encryption, directly impacting enforceability and consistency.
- B. Cost is a secondary concern; the primary goal of the policy is effective security and compliance.
- D. While it might burden IT staff, the primary weakness is the inability to ensure consistent and effective security.
Actionable Security Policy
An actionable security policy is clear, concise, and provides sufficient detail to guide consistent implementation and enforceability, including technical specifications where necessary.
- Must be unambiguous.
- Should be measurable and auditable.
- Requires supporting standards and procedures.
Memory trick: An effective policy is 'CLEAR' – Consistent, Legible, Enforceable, Actionable, Relevant.