Study. uk . com
  1. Home
  2. All questions
  3. Question 594

CISM study material · question 594 of 1000

An organisation with an agile delivery model wants to iterate between RMF steps rather than run them once in order. What does SP 800-37 permit?

  1. Only the Monitor step may be repeated
  2. Only Prepare must come first; the remaining steps may be carried out non-sequentially where the system type or a leadership decision calls for it
  3. Non-sequential execution requires a written waiver from the authorising official, granted for each individual system before any part of the work begins on it
  4. The steps must always be executed in strict order, whatever the system type may be or whichever of the delivery models the organisation has chosen to work to
Show the answer

Answer: B. Only Prepare must come first; the remaining steps may be carried out non-sequentially where the system type or a leadership decision calls for it

SP 800-37 states that after completing the Prepare step the remaining steps are typically sequential on first execution, but there may be many points where divergence is needed due to system type, senior leadership decisions, or iterative cycles such as agile development.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.2 RMF Steps and Structure

Challenge yourself on this topic → Study as cards