Study. uk . com
  1. Home
  2. All questions
  3. Question 593

CISM study material · question 593 of 1000

Which two activities does the RMF Monitor step include beyond assessing control effectiveness? Choose two.

  1. Selecting the control baseline that the system will run to
  2. Documenting changes to the system and its environment of operation
  3. Categorising the information that the system processes, stores or else transmits
  4. Conducting risk assessments and impact analyses
Show the answer

Answer: B. Documenting changes to the system and its environment of operation
D. Conducting risk assessments and impact analyses

SP 800-37 states the Monitor step monitors the system and controls on an ongoing basis, including assessing control effectiveness, documenting changes to the system and environment, conducting risk assessments and impact analyses, and reporting posture.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.2 RMF Steps and Structure

Challenge yourself on this topic → Study as cards