Study. uk . com
  1. Home
  2. All questions
  3. Question 624

CISM study material · question 624 of 1000

How does NIST define a compensating security control?

  1. A control inherited from a common control provider rather than implemented by the system that has come to rely on it
  2. A control applied only to those systems that have been categorised as high impact against the formal analysis of loss
  3. A control that detects failures in another control and then raises an alert to the operator who is on duty whenever one of them occurs
  4. A control used in place of a prescribed baseline control that provides equivalent or comparable protection
Show the answer

Answer: D. A control used in place of a prescribed baseline control that provides equivalent or comparable protection

SP 800-100 defines compensating security controls as the management, operational or technical controls used by an organisation in lieu of prescribed controls in the low, moderate or high baselines, which provide equivalent or comparable protection.

Source: NIST SP 800-100 (NIST) — Sec. 8.4.4 Compensating Controls

Challenge yourself on this topic → Study as cards