A document that sets out the responsibilities of staff and the procedures they must follow to keep systems and information safe
Which term describes the organisation that decides why personal information is collected and how it may be used?
Data controller
What is the name for telling the person responsible for a policy about a problem you have noticed with the way it is being applied?
Reporting a concern
What is meant by a responsibility in an organisation's security policy?
A duty that a member of staff must carry out, such as following procedures
Who is usually responsible for putting most of an organisation's security policies into practice?
IT and technical staff
What are IT managers normally responsible for in relation to security policies?
Writing them and recommending how they should be updated
Priya thinks a security policy at her workplace is not being followed properly. What should she do?
Report it to the person named as responsible for the policy
Which task is the responsibility of an organisation's Data Protection Officer?
Making sure staff know their responsibilities under data protection law
What is expected of every member of staff in relation to the organisation's policies?
Working in line with the policies in their daily role
A new employee has just started work at an organisation. How should they be made aware of their security responsibilities?
Through induction or training that covers the organisation's policies
How are responsibilities for security policies usually shared in a large organisation?
Different policies are the responsibility of different designated employees
A supermarket chain uses the same security policies in every one of its stores. Why is this done?
So that all employees follow the same code of conduct
How might responsibility for the security policies be arranged in a smaller organisation with fewer staff?
One person may manage all of the policies
A company has changed its policy on using removable storage devices. What is the best way to make sure staff know what they must now do?
Tell staff about the change through internal communication or training
Amina is not sure whether her organisation's policy allows her to take a work laptop home. What should she do?
Ask the person named as responsible for the policy
Why does an organisation name the member of staff who is responsible for each security policy?
So that staff know who to contact about that policy
The Data Protection Officer finds that staff are handling customers' personal information in a way that does not meet the law. What is the officer responsible for doing?
Making sure the issue is put right
A team leader asks a member of staff to share their login details with a colleague, which goes against the organisation's security policy. What should the member of staff do?
Refuse to share the details and report the concern
Why does a password policy set a minimum number of characters for passwords?
Longer passwords take more time to crack by brute force
Which password rule is about creating a password rather than protecting it?
Include a mixture of upper and lower case letters and numbers
Why is it a risk for staff to reuse the same password across several accounts?
If one password is compromised, a hacker can access every account
Why do organisations put an acceptable software policy in place?
To stop unapproved software introducing malware to the network
An employee needs software that is not installed on their computer. What should they do?
Ask the IT manager to approve and install the software
What is the purpose of a software audit?
To check which software is installed and whether it is licensed
Which action is part of hardening a device?
Disable unused ports and reset the default passwords
Two members of staff share one login so they can cover each other's shifts. Why does this go against a password policy?
Anyone who learns the password can access the organisation's data
A password policy says that staff must not use their pet's name or their date of birth in a password. Why is this?
These details can be found online, so they are easy to guess
How does an acceptable software policy help to protect an organisation from legal action?
It makes sure only licensed software is installed on its computers
Why are most staff who use an organisation's network not given administrative rights?
So they cannot install software that has not been approved
A software audit finds that a database program is installed on twenty computers but is only needed by the finance team. Why is this a problem?
The organisation may be paying for licences it does not need
Why does device hardening include removing the software and services that a user does not need?
Each one could contain a weakness that an attacker could use
Why do password policies usually require staff to change their passwords at regular intervals?
A discovered password can only be used for a short time
Which term describes the rules an organisation sets for how staff should create and protect their login details?
Password policy
What is meant by an acceptable software policy?
A set of rules that explains what will be done to prevent the installation and use of unapproved software
What is the name for the process of checking which programs are installed on the computers owned by an organisation?
Software audit
What is meant by device hardening?
Applying measures such as firewalls, software updates and encryption to make a device harder to attack
Which term describes the permissions given to a member of staff that control what they are allowed to see and do on a digital system?
User access rights
What is meant by the principle of least privilege?
Users should be given only the minimum rights they need to carry out their job
Staff are told what they are allowed to do with the organisation's computers, network and data. What is this set of rules called?
Acceptable use policy
What is meant by a password checker?
A tool that shows how weak a password is and how to improve it
Which term describes a document that sets out the procedures an organisation will follow to restore its IT systems and data after an event such as a fire, flood or cyber attack?
Disaster recovery policy
What is meant by 'critical data'?
Data the organisation cannot continue to operate without
Which term describes the set days and times when copies of data are made, and how often these copies are taken?
Backup schedule
What is meant by a 'recovery timeline'?
A plan showing how long the organisation can manage without each of its systems
Which term describes a pre-arranged place where an organisation can continue to work if its main site is damaged or cannot be used?
Alternative location
What is meant by 'backup media'?
The device or platform used to store copies of data, such as tapes or the cloud
What is meant by a recovery task in a disaster recovery policy?
A job given to a member of staff to carry out after a disaster
Which term describes copies of an organisation's data that are kept so the data can be restored if the originals are lost or damaged?
Backups
Recovery tasks in a disaster recovery policy are linked to a job role rather than a named person. Why is this better?
So the task is still carried out if that person leaves
A disaster recovery policy states that all staff must know the recovery procedures, even those with no recovery tasks. What is the benefit of this?
They know what to do and who to contact
According to good practice, which type of data should be backed up most frequently?
The critical data the organisation cannot work without
A disaster recovery policy says that systems will be backed up regularly. What is the main problem with this?
It does not say how often backups will be taken
Why should an organisation store its backup copies away from its main site?
So the backups survive a fire or flood at the main site
A disaster recovery policy includes a timeline for restoring systems. Why should critical systems be restored before less important systems?
The organisation can only manage without them for a short time
A flood forces a company to move to a second site. What must the disaster recovery policy confirm is available there?
The hardware, software and personnel needed to run the systems
A disaster recovery policy says how often data is backed up and which media are used, but it does not say who is responsible for the backup process. Why is this a problem?
Staff will not know whose job it is to make sure the backups are taken
A disaster recovery policy states when backups are taken, but it does not say where the backups are stored. Why should the policy state this?
So that staff know where to find the backups when data has to be restored
A disaster recovery policy does not give its recovery tasks to particular members of staff. What is the main risk of this?
Some tasks may be duplicated while others are missed
A disaster recovery policy says that all systems will be running again as quickly as possible after a disaster. Why is this not good enough?
It does not say how long the organisation can manage without each system
A disaster recovery policy says that staff may move to another office if the main site cannot be used, but the office is not named. Why is this a problem?
Staff will not know where to go or what will be provided there
An organisation is investigating a security attack on its systems. Which of these must it establish?
The type of attack and the severity level
Why is it important to establish the severity of an attack during the investigation?
It decides the level of response that is needed
A data breach has exposed customers' usernames and passwords. Why should the organisation inform customers quickly?
Customers may use the same details to access other services
An organisation suffers a serious data breach but decides not to report it to the authorities. What is the most likely outcome?
Legal action and possible fines for the organisation
A virus has infected one computer on a company network. Which action manages this attack?
Disconnect the infected computer from the network
What is the main benefit of following the disaster recovery plan after an attack?
The organisation can keep working while remedial action is taken
After systems are restored, which of these is a longer-term remedial action?
Increase the security training given to employees
An organisation has contained a malware attack by disconnecting an infected server. Why should the IT team keep the files on the server instead of deleting them?
It may be needed as evidence for a criminal investigation
A company tells its customers about a data breach. A week later the investigation finds that more customer records were affected. What should the company do?
Send the customers an update with the new information
A company's network is being flooded with unauthorised traffic. Which action would contain this attack?
Block the traffic using a firewall
Which action involves establishing the type and severity of an attack, when it happened, and which processes or services are affected?
Investigate
What is meant by 'manage' as an action taken after an attack?
Isolate the problem by containing the threat as close to its source as possible
What is the name for the action of informing stakeholders, customers and the appropriate authorities, such as the police, once an attack has been discovered?
Respond
What is meant by 'recover' as an action taken after an attack?
Implement the disaster recovery plan and take remedial action so the organisation can carry on working
Which action involves looking back at what went wrong, how it happened and whether it could have been prevented, so that policies and procedures can be improved?
Analyse
What is meant by a 'disaster recovery plan'?
A document that sets out who is responsible for each task, the timeline and the remedial action
We use cookies to enhance your experience. You can manage your preferences or learn more in our Cookie Policy.