Study. uk . com
  1. Home
  2. All questions
  3. Question 263

CISM study material · question 263 of 1000

IR 8286 warns two kinds of control must not be confused. Which pairing describes them correctly?

  1. Internal controls are preventive; security controls are detective
  2. Internal controls apply to systems; security controls to processes
  3. Internal controls are technical measures built into the system itself; security controls are administrative measures imposed on the people who operate it
  4. Internal controls give reasonable assurance objectives are achieved; security controls safeguard confidentiality, integrity and availability
Show the answer

Answer: D. Internal controls give reasonable assurance objectives are achieved; security controls safeguard confidentiality, integrity and availability

IR 8286 defines internal controls as the overarching mechanisms giving reasonable assurance of achieving objectives, and security controls as safeguards prescribed to protect a system's confidentiality, integrity and availability.

Source: NIST IR 8286 (NIST) — Sec. 3 Cybersecurity Risk Considerations

Challenge yourself on this topic → Study as cards