Study. uk . com
  1. Home
  2. All questions
  3. Question 573

CISM study material · question 573 of 1000

Why does NIST say the configuration management process can only begin after the initial control baseline is selected?

  1. Baseline selection is a prerequisite for the authorisation decision that comes after it
  2. The change board cannot be convened earlier
  3. There must be a baseline before there can be a controlled deviation from it
  4. Change requests cannot be raised before categorisation
Show the answer

Answer: C. There must be a baseline before there can be a controlled deviation from it

SP 800-100 states that during acquisition and development, initial baselines of security controls are selected based on the assessed risk level, and after the security controls are established the configuration management process can begin.

Source: NIST SP 800-100 (NIST) — Sec. 14.1 CM in the System Development Life Cycle

Challenge yourself on this topic → Study as cards