Study. uk . com
  1. Home
  2. All questions
  3. Question 590

CISM study material · question 590 of 1000

An organisation plans to select the baseline first and tailor it as a separate later exercise. How does the RMF define the Select step?

  1. It selects an initial set of controls and tailors them, so tailoring is part of selection
  2. It selects the control baseline only, with the tailoring of that baseline belonging to the Implement step
  3. It selects only the common controls, leaving the system-specific ones to be chosen during Implement
  4. It selects controls after they have been assessed
Show the answer

Answer: A. It selects an initial set of controls and tailors them, so tailoring is part of selection

SP 800-37 folds tailoring into Select: an initial set of controls is chosen and then adjusted, on the evidence of a risk assessment, until risk sits at an acceptable level.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.2 RMF Steps and Structure

Challenge yourself on this topic → Study as cards