Study. uk . com
  1. Home
  2. All questions
  3. Question 628

CISM study material · question 628 of 1000

To whom does NIST say responsibility for developing, implementing and assessing a common control should be assigned?

  1. Officials or organisational elements other than the owners of the systems that will inherit the control
  2. The authorising official for each inheriting system, who accepts the residual risk that the control leaves behind
  3. The owner of the system with the highest impact level, whose own requirements are the most demanding of any of them
  4. The external assessor engaged for the annual review
Show the answer

Answer: A. Officials or organisational elements other than the owners of the systems that will inherit the control

SP 800-100 puts common controls in the hands of officials or organisational elements separate from the owners of the systems that will apply or use them.

Source: NIST SP 800-100 (NIST) — Sec. 8.4.5 Common Security Controls

Challenge yourself on this topic → Study as cards