Study. uk . com
  1. Home
  2. All questions
  3. Question 458

CISM study material · question 458 of 1000

Beyond monitoring the controls it provides, which further duty does SP 800-137 place on a common control provider?

  1. Approving the changes made by the owners of each of the systems that inherit those common controls from the provider
  2. Authorising each of the systems that inherit the controls, since the provider already holds all the evidence of their effectiveness
  3. Setting the assessment frequency for every one of the systems that inherits any of the common controls it provides
  4. Distributing the resulting critical security documents to the system owners who rely on those controls
Show the answer

Answer: D. Distributing the resulting critical security documents to the system owners who rely on those controls

SP 800-137 states the common control provider prepares and submits status reports, conducts remediation, updates critical security documents, and distributes them to individual information and system owners and other senior leaders.

Source: NIST SP 800-137 (NIST) — Sec. 2.4 Roles and Responsibilities

Challenge yourself on this topic → Study as cards