Study. uk . com
  1. Home
  2. All questions
  3. Question 595

CISM study material · question 595 of 1000

How does SP 800-37 balance the obligation to perform RMF tasks against organisational flexibility?

  1. Every step and task is executed apart from those marked optional, while substantial flexibility remains in how each is carried out
  2. Only the tasks named in the organisation's policy need be executed
  3. Flexibility applies only to the order in which the tasks are carried out and never to how each of them is performed once it has been reached
  4. Organisations may omit any task that does not fit their environment
Show the answer

Answer: A. Every step and task is executed apart from those marked optional, while substantial flexibility remains in how each is carried out

SP 800-37 states organisations are expected to execute all steps and tasks apart from those labelled optional, while having significant flexibility in how each is carried out, provided requirements are met and risk is effectively managed.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.2 RMF Steps and Structure

Challenge yourself on this topic → Study as cards