Study. uk . com
  1. Home
  2. All questions
  3. Question 634

CISM study material · question 634 of 1000

Who must review and approve the application of scoping guidance to a system's controls?

  1. The security control assessor who examines the result of applying it
  2. The authorising official for that information system
  3. The system owner who applied the guidance in the first instance
  4. The configuration control board that reviews the resulting change request
Show the answer

Answer: B. The authorising official for that information system

SP 800-100 puts review and approval of how scoping guidance was applied with the authorising official for the system in question.

Source: NIST SP 800-100 (NIST) — Sec. 8.4.3 Scoping Guidance

Challenge yourself on this topic → Study as cards