Study. uk . com
  1. Home
  2. All questions
  3. Question 632

CISM study material · question 632 of 1000

Which two organisational conditions does NIST say make identification of common controls work? Choose two.

  1. Coordination and consensus on common control designations is assigned to a management official with programme responsibilities
  2. Every one of the system owners implements exactly the same control baseline, so that nothing at all has to be designated separately anywhere
  3. The organisation has developed, documented and communicated specific guidance on identifying common controls
  4. Common controls are assessed by an external party only
Show the answer

Answer: C. The organisation has developed, documented and communicated specific guidance on identifying common controls
A. Coordination and consensus on common control designations is assigned to a management official with programme responsibilities

SP 800-100 lists factors including published guidance on identifying common controls, assignment of coordination and consensus to a management official such as the information or security officer, briefing of system owners, and consultation of experts.

Source: NIST SP 800-100 (NIST) — Sec. 8.4.5 Common Security Controls

Challenge yourself on this topic → Study as cards