Study. uk . com
  1. Home
  2. All questions
  3. Question 591

CISM study material · question 591 of 1000

Which three things does the RMF Assess step determine about controls?

  1. That they are documented, funded and staffed
  2. That they are implemented correctly, operating as intended, and producing the desired outcomes against the requirements
  3. That they are common, hybrid or system-specific
  4. That they are technical, operational or managerial
Show the answer

Answer: B. That they are implemented correctly, operating as intended, and producing the desired outcomes against the requirements

SP 800-37's Assess step asks three things of a control: was it put in correctly, does it run as designed, and does it deliver what the security and privacy requirements wanted.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.2 RMF Steps and Structure

Challenge yourself on this topic → Study as cards