Study. uk . com
  1. Home
  2. All questions
  3. Question 469

CISM study material · question 469 of 1000

Which four things does monitoring at the system tier confirm about controls, under SP 800-137?

  1. That they are inherited, hybrid, system-specific or compensating, and that each is recorded as such in the system security plan
  2. That they are technical, operational, managerial or physical, and that every one of those four categories is properly represented in the baseline
  3. That they are documented, approved, budgeted and fully staffed before the system is allowed to enter live operation on the network
  4. That they are implemented correctly, operate as intended, produce the desired outcome, and remain effective over time
Show the answer

Answer: D. That they are implemented correctly, operate as intended, produce the desired outcome, and remain effective over time

SP 800-137 asks four things of system-tier controls: right implementation, intended operation, the outcome the security requirement wanted, and continuing effectiveness as time passes.

Source: NIST SP 800-137 (NIST) — Sec. 2.1.3 Tier 3 Information Systems

Challenge yourself on this topic → Study as cards