Study. uk . com
  1. Home
  2. All questions
  3. Question 444

CISM study material · question 444 of 1000

An organisation proposes assessing every aspect of every control continuously. What does SP 800-137 say?

  1. It is required for high-impact systems only
  2. It is the intended target state for a mature programme
  3. It is achievable once monitoring is fully automated
  4. It is impractical, so the answer is reasonable assessment frequencies commensurate with risk
Show the answer

Answer: D. It is impractical, so the answer is reasonable assessment frequencies commensurate with risk

SP 800-137 rejects assessing everything all the time as impractical and substitutes assessment frequencies pitched sensibly against risk.

Source: NIST SP 800-137 (NIST) — Sec. 2.2 Ongoing System Authorizations

Challenge yourself on this topic → Study as cards