Study. uk . com
  1. Home
  2. All questions
  3. Question 24

CISSP study material · question 24 of 500

An architect records a boundary protection control as implemented because a next-generation firewall is deployed with a hardened ruleset. The assessor finds no evidence that the deployed rules behave as designed. Considering the two angles the SP 800-53 Rev. 5 catalogue applies to any control, what is missing?

  1. Assurance: grounds for confidence that the control operates as intended, alongside the strength of the mechanism.
  2. Tailoring: an overlay adapting the control to the specific environment the firewall has been deployed into.
  3. Strength of mechanism: the ruleset must be hardened further before the control can be recorded as implemented.
  4. Baseline selection: the impact level of the system decides whether this control applies to the boundary at all.
Show the answer

Answer: A. Assurance: grounds for confidence that the control operates as intended, alongside the strength of the mechanism.

Rev. 5 pairs mechanism strength with assurance, the confidence a control works as intended. Hardening the ruleset raises strength while still producing no evidence of correct operation.

Source: NIST SP 800-53 Rev. 5 (NIST) — SP 800-53 Rev. 5 > Abstract

Challenge yourself on this topic → Study as cards