Study. uk . com
  1. Home
  2. All questions
  3. Question 457

CISM study material · question 457 of 1000

Which two continuous monitoring duties does SP 800-137 place with the system owner? Choose two.

  1. Establishing and maintaining an inventory of the system's components
  2. Conducting security impact analyses on changes to the system
  3. Approving the organisation-wide monitoring strategy
  4. Determining the organisation's risk tolerance
Show the answer

Answer: A. Establishing and maintaining an inventory of the system's components
B. Conducting security impact analyses on changes to the system

SP 800-137 lists the system owner as developing a system-level strategy, participating in configuration management, maintaining a component inventory, conducting security impact analyses on changes, ensuring controls are assessed, and submitting status reports.

Source: NIST SP 800-137 (NIST) — Sec. 2.4 Roles and Responsibilities

Challenge yourself on this topic → Study as cards