Study. uk . com
  1. Home
  2. All questions
  3. Question 456

CISM study material · question 456 of 1000

Which two decisions does SP 800-137 assign to the authorising official in continuous monitoring? Choose two.

  1. Whether significant system changes require reauthorisation
  2. Which tools will be used to automate the collection of the monitoring data
  3. Whether the risk from operating the system remains acceptable
  4. Which metrics the organisation as a whole will collect each period
Show the answer

Answer: C. Whether the risk from operating the system remains acceptable
A. Whether significant system changes require reauthorisation

SP 800-137 states the authorising official reviews status reports and critical documents, determines whether the risk from operating the system remains acceptable, determines whether significant changes require reauthorisation, and reauthorises when required.

Source: NIST SP 800-137 (NIST) — Sec. 2.4 Roles and Responsibilities

Challenge yourself on this topic → Study as cards