Study. uk . com
  1. Home
  2. All questions
  3. Question 459

CISM study material · question 459 of 1000

In what order does SP 800-137 say the security control assessor produces and uses the security assessment plan?

  1. Assessments are conducted first and the plan documents what was done
  2. The plan is written by the system owner and executed by the assessor
  3. The plan is developed for each control and submitted for approval before assessments are conducted
  4. The plan is produced only where the control is common rather than system-specific
Show the answer

Answer: C. The plan is developed for each control and submitted for approval before assessments are conducted

SP 800-137 states the assessor develops a security assessment plan for each control, submits the plan for approval prior to conducting assessments, conducts the assessments as defined, and updates the report and plan as needed.

Source: NIST SP 800-137 (NIST) — Sec. 2.4 Roles and Responsibilities

Challenge yourself on this topic → Study as cards