Study. uk . com
  1. Home
  2. All questions
  3. Question 638

CISM study material · question 638 of 1000

A minor application runs inside a larger general support system. What does NIST say about its security plan?

  1. The application must be merged into the larger system's own authorisation boundary and so lose its own separate identity in the organisation's overall inventory of all its systems
  2. No separate plan is needed because the controls come from the larger system; a standalone minor application is described in a nearby system's plan
  3. The application must be authorised separately by its own authorising official before it may be used by anybody anywhere in the whole organisation at all, ever
  4. A separate plan is required for every application without any exception at all, however small the application happens to be and wherever in the estate it runs
Show the answer

Answer: B. No separate plan is needed because the controls come from the larger system; a standalone minor application is described in a nearby system's plan

SP 800-100 states specific security plans for minor applications are not required because the controls are typically provided by the general support system or major application in which they operate, and that an unconnected minor application should be briefly described in a nearby system's plan.

Source: NIST SP 800-100 (NIST) — Sec. 8.1 Major Applications and General Support Systems

Challenge yourself on this topic → Study as cards