Study. uk . com
  1. Home
  2. All questions
  3. Question 598

CISM study material · question 598 of 1000

Which three designations does NIST use for controls, and what governs the designation?

  1. Preventive, detective or corrective, governed by their effect
  2. System-specific, hybrid, or common and inherited, governed by the architecture and any tailored baselines or overlays
  3. Mandatory, recommended or optional, governed by the baseline
  4. Technical, operational or managerial, governed by who implements each of them within the organisation and at which of the tiers
Show the answer

Answer: B. System-specific, hybrid, or common and inherited, governed by the architecture and any tailored baselines or overlays

SP 800-37 labels controls system-specific, hybrid, or common and inherited, with the enterprise and security or privacy architectures and any tailored baselines or overlays driving the label.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.1 Organization-Wide Risk Management

Challenge yourself on this topic → Study as cards