Try our Free Demo Practice Tests for Comprehensive CGRC Exam Preparation

Which of the following is a key consideration when implementing security controls for an information system?

The purpose of the asset identification task is to identify assets that require protection. Which of the following is not a potential input for this task?

Which of the following is a key factor in the success of a security awareness and training program?

ABC Corporation is considering implementing a new information system that will be critical to its business operations. The system is expected to cost $1 million to implement, and will be used to process sensitive customer information. The chief information officer (CIO) is concerned about the risks associated with the new system, and wants to ensure that the organization's risk appetite is taken into account. Which of the following factors should be considered when determining the risk appetite for the new system?

True or False: During control selection, all controls may be specialized with tailoring.