1. Which of the following is the FIRST step required to achieve effective performance measurement?

• A. Select and place sensors
• B. Implement control objectives
• C. Validate and calibrate metrics
• D. Define meaningful metrics

2. Which of the following is the MOST effective approach to communicate general information security responsibilities across an organization?

• A. Require staff to sign confidentiality agreements.
• B. Develop a RACI matrix for the organization.
• C. Specify information security responsibilities in job descriptions.
• D. Provide regular security awareness training.

3. An information security manager has been tasked with developing materials to update the board, regulatory agencies, and the media about a security incident. Which of the following should the information security manager do FIRST?

• A. Invoke the organization's incident response plan.
• B. Set up communication channels for the target audience.
• C. Determine the needs and requirements of each audience.
• D. Create a comprehensive singular communication.