Study. uk . com
  1. Home
  2. All questions
  3. Question 622

CISM study material · question 622 of 1000

An organisation tailors its control baseline but records only the final control set. Which requirement is unmet?

  1. Tailoring must be limited to three controls per system in any single annual review cycle
  2. All tailoring activities must be documented in the system security plan
  3. Tailoring must be reviewed by the external assessor
  4. Tailoring must be approved by the information owner
Show the answer

Answer: B. All tailoring activities must be documented in the system security plan

SP 800-100 states the system security plan should document all tailoring activities, so a reader can see how the baseline was changed and on what basis.

Source: NIST SP 800-100 (NIST) — Sec. 8.4.2 Security Controls

Challenge yourself on this topic → Study as cards