Study. uk . com
  1. Home
  2. All questions
  3. Question 547

CISM study material · question 547 of 1000

An organisation engages an external security provider and finds long-established internal controls no longer make sense. How does NIST characterise this?

  1. Long-accepted internal controls and business practices may have to be reconsidered when an external provider is engaged
  2. The provider must adopt the organisation's existing controls without modification, so that operational continuity is fully preserved
  3. The change indicates the provider was selected incorrectly
  4. The internal controls should be preserved entirely unchanged to maintain continuity, whatever the incoming provider may recommend
Show the answer

Answer: A. Long-accepted internal controls and business practices may have to be reconsidered when an external provider is engaged

SP 800-100 accepts that controls and practices built up over years out of business unit divisions or regulatory demands may not survive contact with an external provider, and may need rethinking.

Source: NIST SP 800-100 (NIST) — Table 12-3 Service Issue Categories

Challenge yourself on this topic → Study as cards