Study. uk . com
  1. Home
  2. All questions
  3. Question 601

CISM study material · question 601 of 1000

Why does SP 800-37 require common controls to be identified, documented and published?

  1. So system owners know what they can rely on and inherit rather than rebuild
  2. So the authorising official can approve each of them individually before it is offered for inheritance
  3. So they can be excluded from each individual system security plan that happens to inherit them
  4. So the external assessor is able to verify that each one of them does in fact already exist
Show the answer

Answer: A. So system owners know what they can rely on and inherit rather than rebuild

SP 800-37's common control identification task requires that common controls available for inheritance by organisational systems be identified, documented and published.

Source: NIST SP 800-37 Rev. 2 (NIST) — Table 1 Prepare Tasks — Organization Level

Challenge yourself on this topic → Study as cards