Chapter 6

Asset Value, Policies, and Roles

THE CISSP EXAM TOPICS COVERED IN THIS CHAPTER INCLUDE:

• Information Security Governance and Risk Management
  • Understand and align security function to goals, mission, and objectives of the organization
  • Understand and apply security governance
    • Organizational processes; define security roles and responsibilities; legislative and regulatory compliance; privacy requirements compliance; control frameworks; due care; due diligence
  • Develop and implement security policy
    • Security policies; standards/baselines; procedures; guidelines; documentation
  • Define and implement information classification and ownership
  • Ensure security in contractual agreements and procurement processes
  • Understand and apply risk management concepts
    • Identify threats and vulnerabilities; risk assessment/analysis; risk assignment/acceptance; countermeasure selection