Study. uk . com
  1. Home
  2. All questions
  3. Question 626

CISM study material · question 626 of 1000

A system team decides to substitute a compensating control and records it in their own change log only. Which requirement is unmet?

  1. The compensating control must be reported to the regulator before it may be relied upon in place of the control prescribed in the baseline
  2. Use of the compensating control must be reviewed, documented in the security plan and approved by the authorising official
  3. The compensating control must be reviewed annually
  4. The compensating control must be tested before deployment
Show the answer

Answer: B. Use of the compensating control must be reviewed, documented in the security plan and approved by the authorising official

SP 800-100 requires a compensating control to be reviewed, written into the system security plan, and approved by the authorising official. A team change log satisfies none of that.

Source: NIST SP 800-100 (NIST) — Sec. 8.4.4 Compensating Controls

Challenge yourself on this topic → Study as cards