Study. uk . com
  1. Home
  2. All questions
  3. Question 621

CISM study material · question 621 of 1000

Which two activities does NIST include in tailoring a control baseline? Choose two.

  1. Adding controls from an unrelated framework
  2. Applying scoping guidance
  3. Specifying organisation-defined parameters where the control allows them
  4. Removing the controls that the organisation cannot afford either to operate or to maintain
Show the answer

Answer: B. Applying scoping guidance
C. Specifying organisation-defined parameters where the control allows them

SP 800-100 states tailoring activities include the application of scoping guidance, the specification of compensating controls, and the specification of organisation-defined parameters in the security controls where allowed.

Source: NIST SP 800-100 (NIST) — Sec. 8.4.2 Security Controls

Challenge yourself on this topic → Study as cards