CAS-002 question 94 discussion


The Information Security Officer (ISO) is reviewing new policies that have been recently
made effective and now apply to the company. Upon review, the ISO identifies a new
requirement to implement two-factor authentication on the companys wireless system. Due
to budget constraints, the company will be unable to implement the requirement for the
next two years. The ISO is required to submit a policy exception form to the Chief
Information Officer (CIO). Which of the following are MOST important to include when
submitting the exception form? (Select THREE).

  • A. Business or technical justification for not implementing the requirements.
  • B. Risks associated with the inability to implement the requirements.
  • C. Industry best practices with respect to the technical implementation of the current controls.
  • D. All sections of the policy that may justify non-implementation of the requirements.
  • E. A revised DRP and COOP plan to the exception form.
  • F. Internal procedures that may justify a budget submission to implement the new requirement.
  • G. Current and planned controls to mitigate the risks.
Created 4 days, 9 hours ago by