Study. uk . com
  1. Home
  2. All questions
  3. Question 381

CISM study material · question 381 of 1000

Which pairing correctly describes a common control and a common control provider in NIST usage?

  1. A common control is a compensating control; the provider is the authorising official
  2. A common control is inherited by systems rather than implemented separately in each; the provider is the official accountable for it
  3. A common control is any control in the baseline; the provider is the system owner
  4. A common control is one shared between two organisations; the provider is the vendor
Show the answer

Answer: B. A common control is inherited by systems rather than implemented separately in each; the provider is the official accountable for it

NIST defines a common control as a security control inherited by information systems rather than implemented within each, and a common control provider as the organisational official responsible for its development, implementation, assessment and monitoring.

Source: NIST SP 800-39 (NIST) — Sec. 2.2 Multitiered Risk Management

Challenge yourself on this topic → Study as cards