In a company using the 3LoD model, what problem can arise if the 2nd line is significantly stronger than the 1st line?

The first line loses accountability for cybersecurity management

What happens if the 3rd line of defense lacks technical cybersecurity knowledge?

It may produce inaccurate reports and fail to identify key risks

In an organization with strong cybersecurity governance, how should exceptions to security policies be handled?

A formal process involving both 1st and 2nd lines, with risk-based approach

What is a key limitation of using qualitative risk assessments in a GRC program?

They often lack consistency and can be influenced by subjective judgment

In corporate hierarchy, what is a key difference between a CISO reporting to the CIO vs. one reporting to the CRO?

If reporting to the CIO, security may be subordinated to IT operations

studbud

Let's see what you've learned!

7 termsStudBud Administration22 plays

Imported from external platform

Flashcards7 cardsFPractice quizPHost liveL

Questions 7

Answers

1
In a company using the 3LoD model, what problem can arise if the 2nd line is significantly stronger than the 1st line?
The second line loses independence by assuming first-line responsibilities
The third line becomes redundant
There is no impact, as the second line should always be stronger
The first line loses accountability for cybersecurity management
2
what is the main business risk in terms of cyber security?
Outage
Compliance
Ransomware
Business Continuity
3
What happens if the 3rd line of defense lacks technical cybersecurity knowledge?
It does not impact auditing since internal audit focuses only on processes
It may produce inaccurate reports and fail to identify key risks
It strengthens the independence of internal audit
The second line will take over audit responsibilities to compensate
4
In an organization with strong cybersecurity governance, how should exceptions to security policies be handled?
The first line should approve them with no oversight
A formal process involving both 1st and 2nd lines, with risk-based approach
The 2nd line should approve them, with no involvement from the first line
The third line should be responsible for approving exceptions
5
What is a key limitation of using qualitative risk assessments in a GRC program?
They are too complex for non-technical stakeholders to understand
They are more accurate than quantitative risk assessments in cybersecurity
They always provide accurate financial impact estimates
They often lack consistency and can be influenced by subjective judgment
6
In what situation would an external auditor be more effective than an internal cybersecurity audit?
When greater independence and objectivity are needed
When the organization requires a review with deeper technical expertise
All of the above
When the company needs to comply with specific regulations
7
In corporate hierarchy, what is a key difference between a CISO reporting to the CIO vs. one reporting to the CRO?
There is no real difference in practice
If reporting to the CIO, security may be subordinated to IT operations
If reporting to the CIO, the CISO has more influence in business strategy
If reporting to the CRO, the focus is more on technology than risk mgmt.

Let's see what you've learned! Flashcards | StudBud