Study. uk . com
  1. Home
  2. All questions
  3. Question 589

CISM study material · question 589 of 1000

What does categorising a system determine, and what does that determination drive?

  1. The impact of loss for the information processed, stored and transmitted, which drives the initial control selection
  2. The frequency of monitoring, which drives the assessment schedule
  3. The number of controls the system will require, which drives its budget
  4. The system's position within the enterprise architecture, which in turn drives which business owner is accountable for operating it
Show the answer

Answer: A. The impact of loss for the information processed, stored and transmitted, which drives the initial control selection

SP 800-37 states the Categorize step categorises the system and the information it processes, stores and transmits based on an analysis of the impact of loss, which then informs the initial selection of controls.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.2 RMF Steps and Structure

Challenge yourself on this topic → Study as cards