Study. uk . com
  1. Home
  2. All questions
  3. Question 599

CISM study material · question 599 of 1000

Why does SP 800-37 require traceability from each control back to the requirement it satisfies?

  1. To satisfy the external auditor's evidence request at the point at which the annual examination of the whole system is carried out on site
  2. To determine which of the controls may in fact be inherited from a common control provider located somewhere else inside the organisation
  3. To ensure every requirement is addressed through design, development, implementation, operation, maintenance and disposal
  4. To allow controls to be costed individually
Show the answer

Answer: C. To ensure every requirement is addressed through design, development, implementation, operation, maintenance and disposal

SP 800-37 traces controls back to requirements so nothing is left unaddressed as the system moves through design, development, implementation, operation, maintenance and disposal.

Source: NIST SP 800-37 Rev. 2 (NIST) — Sec. 2.1 Organization-Wide Risk Management

Challenge yourself on this topic → Study as cards