Study. uk . com
  1. Home
  2. All questions
  3. Question 616

CISM study material · question 616 of 1000

A drafter proposes to reproduce the entire security policy inside the rules of behaviour. What does NIST advise instead?

  1. The rules cover the controls at a high level and may incorporate the wider body of policy by reference
  2. The rules must reproduce all of the policy text so that users have a single document to read, to sign and to keep
  3. The rules should omit the policy entirely and address only the sanctions that follow a breach of the controls in it
  4. The rules should be replaced by the policy itself
Show the answer

Answer: A. The rules cover the controls at a high level and may incorporate the wider body of policy by reference

SP 800-100 does not intend the rules to duplicate the policy or procedures guide: they touch the relevant controls at a high level, with the wider policy body pulled in by reference.

Source: NIST SP 800-100 (NIST) — Sec. 8.3 Rules of Behavior

Challenge yourself on this topic → Study as cards