Study. uk . com
  1. Home
  2. All questions
  3. Question 631

CISM study material · question 631 of 1000

How does NIST recommend common controls be handled across many system security plans?

  1. Omitted from system plans and recorded only centrally
  2. Summarised in each plan with the underlying detail held by the assessor who examined it
  3. Rewritten in full in each plan so that every one of the plans is entirely self-contained on its own
  4. Documented once and then inserted or imported by reference into each plan
Show the answer

Answer: D. Documented once and then inserted or imported by reference into each plan

SP 800-100 has common controls written up once and then pulled into each system security plan, rather than restated system by system.

Source: NIST SP 800-100 (NIST) — Sec. 8.4.5 Common Security Controls

Challenge yourself on this topic → Study as cards