Study. uk . com
  1. Home
  2. All questions
  3. Question 18

CISSP study material · question 18 of 500

During an audit, a system owner claims the mapping of information types to impact categories binds the agency exactly as tightly as the requirement to categorise its systems. The auditor separates the two distinct assignments that legislation placed on the standards body. Which statement is accurate?

  1. Categorising information and systems is mandatory, while the mapping of information types to categories is recommended guidance.
  2. Categorising information and systems is recommended, while the mapping of information types to categories is a mandatory standard.
  3. Both the categorisation of systems and the mapping of information types to categories are recommendations an agency may waive.
  4. Both the categorisation of systems and the mapping of information types to categories are mandatory for federal systems.
Show the answer

Answer: A. Categorising information and systems is mandatory, while the mapping of information types to categories is recommended guidance.

Legislation asked for a mandatory categorisation standard plus a separate recommending guideline; treating the information-type mapping as binding confuses the guideline with the standard it supports.

Source: NIST SP 800-60 Vol. 1 Rev. 1 (NIST) — SP 800-60 Vol. 1 Rev. 1 > Abstract

Challenge yourself on this topic → Study as cards