Study. uk . com
  1. Home
  2. All questions
  3. Question 605

CISM study material · question 605 of 1000

Which two things does a system security plan contain, according to NIST?

  1. The incident response plan written for the particular system that this security plan itself covers
  2. The organisation's risk appetite statement and the tolerances that sit underneath it at each of the three tiers
  3. An overview of the system's security requirements and the controls in place or planned to meet them
  4. The responsibilities and expected behaviour of all individuals who access the system
Show the answer

Answer: C. An overview of the system's security requirements and the controls in place or planned to meet them
D. The responsibilities and expected behaviour of all individuals who access the system

SP 800-100 gives the plan two jobs: setting out what security the system requires and which controls, present or planned, will meet that; and stating what is expected of everyone who uses it.

Source: NIST SP 800-100 (NIST) — Ch. 8 Security Planning

Challenge yourself on this topic → Study as cards