Study. uk . com
  1. Home
  2. All questions
  3. Question 468

CISM study material · question 468 of 1000

An organisation believes only an external firm can perform an independent control assessment. What does NIST actually require of assessor independence?

  1. Assessors must report directly to the authorising official rather than to the owner of the system that is being assessed
  2. Independence is only from the operation of the system; the assessor may sit inside or outside the organisation
  3. Assessors must always be external to the organisation
  4. Assessors must hold a specified professional certification
Show the answer

Answer: B. Independence is only from the operation of the system; the assessor may sit inside or outside the organisation

SP 800-137 sets the bar at independence from running the system, and allows assessors from the organisation tier, the business tier, or any other body internal or external.

Source: NIST SP 800-137 (NIST) — Sec. 3.1.2 footnote 27

Challenge yourself on this topic → Study as cards