Study. uk . com
  1. Home
  2. All questions
  3. Question 443

CISM study material · question 443 of 1000

How does SP 800-137 contrast an initial authorisation with continuous monitoring?

  1. Initial authorisation rests on evidence from a single point in time, while continuous monitoring keeps assessing effectiveness as conditions change
  2. Initial authorisation covers the common controls that the system inherits, while continuous monitoring covers only those controls specific to that system itself
  3. The two of them produce identical evidence at different intervals, so the only real difference between them is how often that very same assessment happens to be repeated in each year
  4. Initial authorisation is a technical exercise carried out by assessors, while continuous monitoring is a managerial exercise carried out by the system owners
Show the answer

Answer: A. Initial authorisation rests on evidence from a single point in time, while continuous monitoring keeps assessing effectiveness as conditions change

SP 800-137 contrasts a snapshot with a film: the first authorisation rests on evidence from one moment, while ongoing assessment carries authorisation forward as threats, weaknesses, technologies and processes move.

Source: NIST SP 800-137 (NIST) — Sec. 2.2 Ongoing System Authorizations

Challenge yourself on this topic → Study as cards