Who should DECIDE how a company should approach security and what security measures should be
implemented?

The US department of Health, Education and Welfare developed a list of fair information practices focused on
privacy of individually, personal identifiable information. Which one of the following is incorrect?

The owner of a system should have the confidence that the system will behave according to its specifications.
This is termed as:

In regards to information classification what is the main responsibility of information (data) owner?

Which of the following is NOT a responsibility of an information (data) owner?

Who can best decide what are the adequate technical security controls in a computer-based application system
in regards to the protection of the data being used, the criticality of the data, and its sensitivity level?

Which of the following embodies all the detailed actions that personnel are required to follow?

Who is ultimately responsible for the security of computer based information systems within an organization?

In discretionary access environments, which of the following entities is authorized to grant information access to
other people?

Which of the following is given the responsibility of the maintenance and protection of the data?