Page 128 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

analysis.

Understand the importance of accountability. An
organization’s security policy can be properly enforced only if

accountability is maintained. In other words, security can be
maintained only if subjects are held accountable for their actions.
Effective accountability relies on the capability to prove a subject’s
identity and track their activities.

Be able to explain nonrepudiation. Nonrepudiation ensures that
the subject of an activity or event cannot deny that the event occurred.
It prevents a subject from claiming not to have sent a message, not to

have performed an action, or not to have been the cause of an event.

Understand security management planning. Security
management is based on three types of plans: strategic, tactical, and
operational. A strategic plan is a long-term plan that is fairly stable. It
defines the organization’s goals, mission, and objectives. The tactical
plan is a midterm plan developed to provide more details on

accomplishing the goals set forth in the strategic plan. Operational
plans are short-term and highly detailed plans based on the strategic
and tactical plans.

Know the elements of a formalized security policy structure.
To create a comprehensive security plan, you need the following items
in place: security policy, standards, baselines, guidelines, and
procedures. Such documentation clearly states security requirements

and creates due diligence on the part of the responsible parties.

Understand key security roles. The primary security roles are
senior manager, organizational owner, upper management, security
professional, user, data owner, data custodian, and auditor. By
creating a security role hierarchy, you limit risk overall.

Know how to implement security awareness training. Before
actual training can take place, awareness of security as a recognized

entity must be created for users. Once this is accomplished, training,
or teaching employees to perform their work tasks and to comply with
the security policy, can begin. All new employees require some level of
training so they will be able to comply with all standards, guidelines,