Study. uk . com
  1. Home
  2. All questions
  3. Question 99

CISM study material · question 99 of 1000

A system is about to go live and the project manager proposes assessing control effectiveness after six months of operation. Why does SP 800-39 place that assessment earlier?

  1. The implementation phase is the opportunity to determine control effectiveness before operations commence
  2. Assessment after go-live is prohibited by the framework
  3. The authorising official assesses controls only during disposal
  4. Effectiveness cannot be measured once a system carries live data, because testing a production control would disturb the service
Show the answer

Answer: A. The implementation phase is the opportunity to determine control effectiveness before operations commence

SP 800-39 states the implementation phase provides the opportunity to determine the effectiveness of selected controls before actual operations commence, so expectations can be compared against real behaviour.

Source: NIST SP 800-39 (NIST) — Sec. 2.5 Tier Three — Information Systems View

Challenge yourself on this topic → Study as cards