Study. uk . com
  1. Home
  2. All questions
  3. Question 625

CISM study material · question 625 of 1000

Which two of the three conditions governing the use of a compensating control does NIST state? Choose two.

  1. The organisation assesses and formally accepts the associated risk
  2. The organisation provides a complete and convincing rationale for how it gives equivalent protection
  3. The control is approved by the vendor of the product that it affects before it may be relied upon at all in production
  4. The control is tested by an accredited external laboratory before any use of it
Show the answer

Answer: B. The organisation provides a complete and convincing rationale for how it gives equivalent protection
A. The organisation assesses and formally accepts the associated risk

SP 800-100 states compensating controls are used only where they are selected from the control catalogue, the organisation provides a convincing rationale for equivalent protection, and the organisation assesses and formally accepts the associated risk.

Source: NIST SP 800-100 (NIST) — Sec. 8.4.4 Compensating Controls

Challenge yourself on this topic → Study as cards