A CISA is reviewing an organization's information security policy. The policy states, 'All sensitive data must be protected.' However, it provides no definitions for 'sensitive data,' no criteria for 'protection,' and no specific examples or mandatory controls. Which of the following is the MOST significant deficiency of this policy?
- AInability to enforce compliance or measure effectiveness.
- BInsufficient technical detail for IT staff.
- CFailure to align with industry best practices.
- DLack of management commitment to information security.
Show answer & explanationAnswer & explanation
Correct answer: A. Inability to enforce compliance or measure effectiveness.
A policy that lacks clear definitions, criteria, and specific controls is inherently unenforceable. If employees and IT staff do not understand what 'sensitive data' is or what 'protection' entails, they cannot consistently apply controls, and management cannot effectively measure if the policy is being followed or if it achieves its intended security objectives. This renders the policy ineffective.
Why the other options are wrong
- B. While technical detail is important, the policy's fundamental deficiency lies in its lack of clarity and actionability for all stakeholders, not just IT staff.
- C. Alignment with best practices is good, but the more fundamental issue is the policy's practical utility and enforceability within the organization.
- D. While a policy's weakness can reflect on management commitment, the direct and most significant deficiency is its practical unenforceability due to vagueness.
Actionable Security Policy
An information security policy that is clear, specific, measurable, and enforceable, providing explicit guidance on what constitutes acceptable behavior and mandatory controls, defined terms, and responsibilities.
- Must define terms like 'sensitive data' and 'protection'.
- Should specify controls and responsibilities.
- Enables consistent implementation and auditing of security practices.
Memory trick: Actionable Policy: Clear, Specific, Enforceable.