Study. uk . com
  1. Home
  2. All questions
  3. Question 543

CISM study material · question 543 of 1000

Why might the same system warrant different controls in two different organisations, according to NIST?

  1. Control selection is determined by the size of the security team that is available to operate whatever has been chosen
  2. Controls are assigned by the vendor on the basis of the licence tier that the organisation has chosen to purchase from it
  3. Different organisations interpret the very same published control catalogue differently, so their own control selections tend to diverge
  4. The relative maturity of each organisation's security architecture influences which controls are appropriate
Show the answer

Answer: D. The relative maturity of each organisation's security architecture influences which controls are appropriate

SP 800-100 makes the maturity of the security architecture a factor in what controls suit a given system, so an identical system can warrant a different set in a different organisation.

Source: NIST SP 800-100 (NIST) — Sec. 12.2 Selecting Information Security Services

Challenge yourself on this topic → Study as cards