Study. uk . com
  1. Home
  2. All questions
  3. Question 388

CISM study material · question 388 of 1000

An organisation operates a change board that reviews cost and schedule but has no security participant. Which NIST expectation is not met?

  1. An information security representative participates in the configuration control board
  2. The board publishes minutes to all staff
  3. Every change is approved by the authorising official
  4. Changes are tested in a production-equivalent environment before the change board will approve them
Show the answer

Answer: A. An information security representative participates in the configuration control board

NIST lists among the supporting processes for configuration management that the organisation deploys a configuration control board or similar body and that an information security representative participates in it.

Source: NIST SP 800-100 (NIST) — Table 2-1 Configuration Management

Challenge yourself on this topic → Study as cards