Study. uk . com
  1. Home
  2. All questions
  3. Question 571

CISM study material · question 571 of 1000

How does the access restrictions for change control differ from configuration change control?

  1. It restricts the number of changes made per period
  2. It restricts changes to a defined maintenance window, so that any disruption falls outside business hours
  3. It enforces who is permitted to make changes, separately from approving what the change is
  4. It applies only to changes affecting security settings, leaving functional changes to the ordinary process
Show the answer

Answer: C. It enforces who is permitted to make changes, separately from approving what the change is

NIST lists access restrictions for change as a distinct control requiring the organisation to enforce access restrictions associated with changes to the system, separate from the control governing documentation and approval of changes.

Source: NIST SP 800-100 (NIST) — Table 14-1 CM Control Family

Challenge yourself on this topic → Study as cards