Progress Test 1 (Cybersecurity Professional English)

TASK 1. READING

1. What is the main purpose of the annual information security review?

ANNUAL INFORMATION SECURITY REVIEW

(1) Every year the information security section of Signal Unit 2140 carries out a full review of the unit’s protection. The purpose of the review is not to find the servicemen who have made mistakes, but to show the commander where the unit is weak and how much it would cost to become stronger. The review of 2026 was completed on 14 March and covered four areas: physical security, access control, network protection and the training of personnel.

(2) The first part of the review is always the register of assets. An asset is anything that has value for the unit: a server, a radio station, a database, and also the knowledge of a specialist. This year the register contained 418 items, of which 63 were classified as critical. For every critical asset the team estimated two things — how likely an incident is, and how serious the damage would be. The combination of the two gives the level of risk, and this year eleven assets were placed in the highest category.

(3) The second part is the list of measures. Not every risk can be removed; some can only be reduced, and what remains after all the measures is called residual risk. The team proposed nine measures and ranked them by cost. The cheapest of them, and in the opinion of the team the most useful, is awareness training for all personnel: it costs almost nothing and it reduces the risk of social engineering, which was named as the most common cause of incidents in the unit during the last two years.

(4) The third part is the plan. Four measures are to be implemented before 1 September; the rest require funds that the unit does not yet have, so they were included in the request for the next year. The head of the section, Major Kolisnyk, is responsible for the plan and reports on it monthly. Questions about the review may be addressed to the section by telephone, extension 274.

2. Which figure refers specifically to assets requiring the highest level of protection?

ANNUAL INFORMATION SECURITY REVIEW
The first part of the review is always the register of assets. An asset is anything that has value for the unit: a server, a radio station, a database, and also the knowledge of a specialist. This year the register contained 418 items, of which 63 were classified as critical. For every critical asset, the team estimated two things — how likely an incident is, and how serious the damage would be. The combination of the two gives the level of risk, and this year, eleven assets were placed in the highest category.

3. Which statement best summarises paragraph 3?

ANNUAL INFORMATION SECURITY REVIEW
(3) The second part is the list of measures. Not every risk can be removed; some can only be reduced, and what remains after all the measures is called residual risk. The team proposed nine measures and ranked them by cost. The cheapest of them, and in the opinion of the team the most useful, is awareness training for all personnel: it costs almost nothing and it reduces the risk of social engineering, which was named as the most common cause of incidents in the unit during the last two years.