PECB Lead-Cybersecurity-Manager Exam - Topic 5 Question 21 Discussion

Actual exam question for PECB's Lead-Cybersecurity-Manager exam

Question #: 21
Topic #: 5

[All Lead-Cybersecurity-Manager Questions]

Scenario 2: Euro Tech Solutions Is a leading technology company operating in Europe that specializes In providing Innovative IT solutions With a strong reputation for reliability and excellence. EuroTech Solutions offers a range of services, including software development, cloud computing, and IT consulting. The company is dedicated to delivering cutting-edge technology solutions that drive digital transformation and enhance operational efficiency for its clients.

Recently, the company was subject to a cyberattack that significantly impeded its operations and negatively impacted Its reputation. The cyberattack resulted in a major data breach, where the customers' data and sensitive Information ware leaked. As such, EuroTech Solutions identified the need to improve its cybersecurity measures and decided 1o implement o comprehensive cybersecurity program.

EuroTech Solutions decided to use ISO.'I EC 27032 and the NIST Cybersecurity Framework as references and incorporate their principles and recommendations into its cybersecurity program. The company decided to rapidly implement the cybersecurity program by adhering to the guidelines of these two standards, and proceed with continual improvement (hereafter.

Initially, the company conducted a comprehensive analysis of its strengths, weaknesses, opportunities, and threats to evaluate its cybersecurity measures. This analysis helped the company to identify the desired stale of its cybersecurity controls. Then, it identified the processes and cybersecurity controls that are in place, and conducted a gap analysis to effectively determine the gap between the desired state and current state of the cybersecurity controls. The cybersecurity program included business and IT-related functions and was separated into three phases

1. Cybersecurity program and governance

2. Security operations and incident response

3. Testing, monitoring, and improvement

With this program, the company aimed to strengthen the resilience of the digital infrastructure through advanced threat detection, real time monitoring, and proactive incident response. Additionally, it decided to droit a comprehensive and clear cybersecurity policy as part of its overall cybersecurity program The drafting process involved conducting a thorough research and analysis of existing cybersecurity frameworks Once the initial draft was prepared, the policy was reviewed, and then approved by senior management. After finalizing the cybersecurity policy, EuroTech Solutions took a proactive approach to its initial publication. The policy was communicated to all employees through various channels, including internal communications, employee training sessions, and the company's intranet network.

Based on the scenario above, answer the following question

Based on scenario 2. the cybersecurity policy was approved by senior management. Is this appropriate?

AYes, the cybersecurity policy must be approved by the management

BNo, the cybersecurity policy must be approved only by the CEO

CNo, the cybersecurity policy must be approved only by the security governance committee

Show Suggested Answer

Suggested Answer: A

The approval of the cybersecurity policy by senior management is appropriate and aligns with best practices in cybersecurity governance. Management approval ensures that the policy is given the necessary authority and support for effective implementation. This practice is crucial for demonstrating top-level commitment to cybersecurity within the organization.

ISO/IEC 27001 requires that the information security policy is approved by management to ensure alignment with the organization's objectives and regulatory requirements. Similarly, NIST SP 800-53 and other standards emphasize the role of senior management in approving and endorsing security policies to ensure they are effectively implemented and enforced.

ISO/IEC 27001:2013 - Specifies that top management must establish, approve, and communicate the information security policy to ensure organizational alignment and support.

NIST SP 800-53 - Highlights the importance of management's role in establishing and approving security policies and procedures to ensure their effective implementation.

by Avery at Apr 06, 2025, 03:11 AM

Limited Time Offer

25%

Off

Get Premium Lead-Cybersecurity-Manager Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Cathrine

2 months ago

Good to see they're taking cybersecurity seriously after that breach!

upvoted 0 times

...

Florinda

2 months ago

Seems like a solid approach, management approval is key.

upvoted 0 times

...

Queen

2 months ago

Yes, the cybersecurity policy must be approved by the management

upvoted 0 times

...

Roosevelt

3 months ago

I disagree, it should be the CEO who signs off on it!

upvoted 0 times

...

Tiara

3 months ago

Wait, is it really enough just to have management approve it?

upvoted 0 times

...

Inocencia

3 months ago

I thought the cybersecurity policy should involve the security governance committee too. But if senior management is involved, that seems appropriate as well.

upvoted 0 times

...

Amie

3 months ago

I practiced a similar question where the focus was on governance. I feel like having senior management approve the policy is generally a good practice.

upvoted 0 times

...

Tijuana

4 months ago

I'm not entirely sure, but I think it might depend on the company's structure. Isn't it possible for the CEO to delegate that responsibility?

upvoted 0 times

...

Vincenza

4 months ago

I remember discussing the importance of management approval for policies in our cybersecurity class. It seems crucial for alignment with business objectives.

upvoted 0 times

...

Alana

4 months ago

Based on the information provided, I believe the answer is A. The scenario clearly states that the cybersecurity policy was approved by senior management, which seems appropriate given the importance of cybersecurity for the company's operations and reputation.

upvoted 0 times

...

Sherrell

4 months ago

I'm a little confused by the options here. Option B says the policy should only be approved by the CEO, but the scenario mentions it was approved by senior management. And option C talks about a security governance committee, which isn't mentioned in the scenario. I'm leaning towards A, but I'm not 100% sure.

upvoted 0 times

...

Narcisa

4 months ago

I think the key here is that the policy was approved by senior management, not just a single individual like the CEO. That seems like the right approach to me, as cybersecurity is a company-wide concern that requires buy-in from leadership. I'll go with A.

upvoted 0 times

...

Pauline

5 months ago

Hmm, I'm a bit unsure about this one. The question is asking if the approval by senior management is appropriate, but it doesn't specify exactly who should be approving the policy. I'll need to think this through carefully.

upvoted 0 times

...

Shala

5 months ago

This seems like a straightforward question. The scenario clearly states that the cybersecurity policy was approved by senior management, so I believe the appropriate answer is A.

upvoted 0 times

...

Terrilyn

9 months ago

I'm not surprised the policy was approved by senior management. After all, they're the ones who'll be held accountable if a major cyberattack happens. Better safe than sorry, right?

upvoted 0 times

...

Adaline

9 months ago

Haha, can you imagine if the CEO had to approve every cybersecurity policy? That's like asking the janitor to approve the company's financial statements. Senior management is the way to go!

upvoted 0 times

Ashley

8 months ago

A) Yes, the cybersecurity policy must be approved by the management

upvoted 0 times

...

Lovetta

8 months ago

Haha, can you imagine if the CEO had to approve every cybersecurity policy? That's like asking the janitor to approve the company's financial statements. Senior management is the way to go!

upvoted 0 times

...

Meghan

9 months ago

A) Yes, the cybersecurity policy must be approved by the management

upvoted 0 times

...

Delsie

10 months ago

I agree. Senior management approval is crucial for the successful implementation and enforcement of the cybersecurity policy. They have the authority to allocate resources and drive the necessary changes.

upvoted 0 times

Lindsay

8 months ago

C) No, the cybersecurity policy must be approved only by the security governance committee

upvoted 0 times

...

Marvel

8 months ago

upvoted 0 times

...

Franchesca

9 months ago

A) Yes, the cybersecurity policy must be approved by the management

upvoted 0 times

...

Sheron

10 months ago

I disagree. The cybersecurity policy should be approved by the security governance committee for better oversight.

upvoted 0 times

...

Catalina

10 months ago

Absolutely, the cybersecurity policy should be approved by senior management. They need to be involved in the decision-making process to ensure the policy aligns with the company's overall strategic goals.

upvoted 0 times