Study. uk . com
  1. Home
  2. All questions
  3. Question 596

CISM study material · question 596 of 1000

A team wants to select, tailor, implement and assess controls progressively as a system is built rather than in a single pass. Is this permitted?

  1. No — incremental assessment invalidates the eventual authorisation, which must rest on a single assessment of the finished system
  2. Yes, but only for those systems that have already been categorised as low impact against the formal analysis of loss
  3. No — each of the activities must be completed for the whole of the system before the next one of them is allowed to begin
  4. Yes — flexible implementation allows these activities to be done incrementally as the system is developed
Show the answer

Answer: D. Yes — flexible implementation allows these activities to be done incrementally as the system is developed

SP 800-37 states flexibility of implementation applies to control selection, tailoring and assessment throughout the life cycle, and that these can be done incrementally as a system is being developed.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.2 RMF Steps and Structure

Challenge yourself on this topic → Study as cards