Quiz: Security Governance
A 26-question self-check covering the document hierarchy, frameworks, roles and RACI, and the policy lifecycle. Several questions are tagged with the certification domain they map to — [Sec+] for CompTIA Security+ and [CISSP] for the (ISC)² CISSP — so certification candidates can self-assess. Answers and one-line explanations are at the end; try the whole quiz before checking.
Section 1 — Multiple choice (1 pt each)
1. [Sec+] A high-level, mandatory statement of management intent that is deliberately technology-neutral and approved at a senior level is a: A. standard B. procedure C. policy D. guideline
2. [Sec+] Which governance document is the only one that is not mandatory? A. policy B. standard C. procedure D. guideline
3. "All passwords must be at least 14 characters and checked against a breach corpus" is an example of a: A. policy B. standard C. procedure D. guideline
4. [CISSP] Setting organizational direction and providing oversight, as distinct from executing within that direction, defines: A. management B. governance C. operations D. administration
5. [Sec+] In a RACI matrix, how many roles should be marked Accountable for a single task? A. zero B. exactly one C. at least two D. as many as are involved
6. Which was newly added as a top-level Function in NIST CSF 2.0 relative to CSF 1.1? A. Identify B. Detect C. Govern D. Recover
7. [CISSP] ISO/IEC 27001 is best described as: A. a U.S. voluntary outcome framework B. a certifiable international standard for an information security management system C. a catalog of web-application vulnerabilities D. a U.S. federal regulation
8. The named individual accountable that a specific control is designed, operated, and remains effective — not necessarily the person who performs it — is the: A. data owner B. system administrator C. control owner D. auditor
9. [Sec+] Which lifecycle stage is most commonly neglected and is where stale documents originate? A. draft B. approve C. review & maintain D. publish
10. A foundational, board- or CEO-approved document that establishes the security program's authority, scope, mandate, and reporting lines is the: A. acceptable use policy B. security charter C. risk register D. statement of applicability
11. [CISSP] The amount and type of risk an organization is willing to accept in pursuit of its objectives, set by the board, is its: A. residual risk B. risk appetite C. risk register D. attack surface
12. Achieving framework coverage through a few broad policies (with detail pushed into standards and procedures) rather than a separate policy per topic is preferred mainly because it: A. looks more impressive to auditors B. reduces the maintenance/review burden and orphaned documents C. is required by ISO 27001 D. eliminates the need for procedures
13. [Sec+] Which document would specify the exact step-by-step instructions to disable a departed employee's accounts? A. policy B. standard C. procedure D. guideline
14. The most dangerous governance gap is usually: A. a missing guideline B. a policy with no standard beneath it (intent with no teeth) C. too many procedures D. an extra review cycle
Section 2 — True / False with justification (1 pt each)
For each, mark T or F and give a one-sentence reason.
15. "A guideline is a mandatory requirement that must be enforced like a standard."
16. [Sec+] "Adopting the NIST Cybersecurity Framework means an organization is secure."
17. "A policy that has been drafted but not formally approved is still binding on employees."
18. "The person who performs a control must always be the same person who is accountable for it."
19. [CISSP] "A program that forbids all policy exceptions is more secure than one with a governed exception process."
20. "Because the board sets risk appetite and approves policy, governance is the board's job and management merely executes it."
Section 3 — Fill in the blank (1 pt each)
21. From most abstract to most specific, the mandatory governance documents are policy, _, and _; the one non-mandatory tier is the __.
22. [Sec+] The six NIST CSF 2.0 Functions are Govern, _, Protect, _, Respond, and Recover.
23. In a RACI matrix, the four letters stand for Responsible, _, Consulted, and _.
Section 4 — Short answer (2 pts each)
24. [CISSP] Explain why governance is what lets a security program scale and survive turnover, using the distinction between a documented, owned control and an undocumented habit.
25. A standard at Meridian was last reviewed four years ago and still permits an obsolete cipher. Explain how this single stale document simultaneously harms (a) the auditor's view of the program, (b) the organization's actual security, and (c) the organization's own defenders.
26. [Sec+] Distinguish a control owner from a data owner or a system administrator, and explain what the examiner's question "who owns this control and when was it last reviewed?" is really testing.