Study. uk . com
  1. Home
  2. All questions
  3. Question 93

CISM study material · question 93 of 1000

A system cannot achieve the level of trustworthiness needed from its technical controls alone. What does SP 800-39 say the organisation should do?

  1. Employ management and operational controls as compensating controls
  2. Lower the system's security categorisation
  3. Accept the residual risk without further action
  4. Halt deployment until trustworthy technology exists
Show the answer

Answer: A. Employ management and operational controls as compensating controls

SP 800-39 states that when technical controls are less than effective because of achievable levels of trustworthiness, management and operational controls are employed as compensating controls, providing another opportunity to manage risk.

Source: NIST SP 800-39 (NIST) — Sec. 2.5 Tier Three — Information Systems View

Challenge yourself on this topic → Study as cards