Use the following scenario to answer the next three question…

Use the following scenario to answer the next three questions.   Mary has just been hired as the new security officer for a pharmaceutical company.  The company has experienced many data breaches and has charged Mary with ensuring that the company is better protected.  The company currently has the following classifications in place: public, confidential and secret.  There is a data classification policy that outlines the classification scheme and the definitions for each classification, but there is not supporting documentation that the technical staff can follow to know how to meet these goals.  The company has no data loss prevention controls in place and only conducts basic security awareness training once per year.  Talking to the business unit managers, she finds out that only half of them even know where the company’s policies are located and none of them know their responsibilities pertaining to classifying data. Which of the following best describes what Mary should address first in this situation?

Management requires that all employees with a company laptop…

Management requires that all employees with a company laptop for remote and at-home use keep their virus signatures up to date and run a full system scan at least weekly. It is suggested, however, that they update signatures every night if possible.  In what document type would such suggestions likely be made?

Place the following risk assessment steps in order, from las…

Place the following risk assessment steps in order, from last to first. I.  Derive Annualized loss expectancy (ALE) II.  Inventory assets and assign Asset Value III.  Determine the cost/benefit of the safeguard IV. Calculate Single Loss Expectancy (SLE)   A.  II, III, I, IV B.  III, IV, I, II C.  III, I, IV, II D.  II, IV, I, III