Study. uk . com
  1. Home
  2. All questions
  3. Question 58

CISM study material · question 58 of 1000

A team issues a procedure that relaxes a requirement stated in the approved security policy, arguing the procedure is more current. How should the security manager respond?

  1. Both remain in force and teams may choose which to follow
  2. The more recent document prevails, so the procedure stands until the next scheduled policy review brings the two back into line
  3. Guidance and procedures may not supersede policy; if the requirement must change, the policy itself is amended
  4. Procedures always override policy where the two conflict on technical matters, because the procedure is written by the team that operates the control
Show the answer

Answer: C. Guidance and procedures may not supersede policy; if the requirement must change, the policy itself is amended

SP 800-100 subordinates later guidance to the approved policy: it must stay consistent with policy and cannot override it. Changing the requirement means amending the policy itself.

Source: NIST SP 800-100 (NIST) — Sec. 2.2.5 Policy and Guidance

Challenge yourself on this topic → Study as cards