Study. uk . com
  1. Home
  2. All questions
  3. Question 609

CISM study material · question 609 of 1000

Which two decisions does NIST assign to the information owner? Choose two.

  1. Approving the system's authorisation to operate
  2. Establishing the rules for appropriate use and protection of the data
  3. Selecting the technical controls for the hosting platform
  4. Deciding who has access to the system and what privileges they hold
Show the answer

Answer: B. Establishing the rules for appropriate use and protection of the data
D. Deciding who has access to the system and what privileges they hold

SP 800-100 states the information owner establishes rules of behaviour for the data, provides input on security requirements to system owners, decides who has access and what privileges or access rights they receive, and assists in identifying common controls.

Source: NIST SP 800-100 (NIST) — Sec. 8.2.3 Information Owner

Challenge yourself on this topic → Study as cards