Study. uk . com
  1. Home
  2. All questions
  3. Question 649

CISM study material · question 649 of 1000

Two systems with different configurations and control sets are to be interconnected. Why does NIST say the resulting risk must be weighed carefully?

  1. Because interconnection is prohibited between systems of different impact levels
  2. Because categorisation and control guidance apply to individual systems, so connecting differing systems creates risk neither categorisation captures
  3. Because the connection invalidates both systems' authorisations
  4. Because the lower-categorised system must be recategorised upward
Show the answer

Answer: B. Because categorisation and control guidance apply to individual systems, so connecting differing systems creates risk neither categorisation captures

SP 800-100 notes categorisation and its guidance are written for one system at a time, so joining systems that differ in configuration or controls creates risk that needs weighing on its own.

Source: NIST SP 800-100 (NIST) — Sec. 6.1 Managing System Interconnections

Challenge yourself on this topic → Study as cards