A governance team wants one control catalogue to serve the whole organisation, so that a single register covers every obligation the board tracks. They ask which concerns beyond classic information security the twenty SP 800-53 Rev. 5 families already govern. Choose two.

Question

Answer 1

Show the answer

Answer: C. How personally identifiable information is processed and disclosed
B. Risk introduced by suppliers and the wider supply chain

Rev. 5 consolidates privacy over personal information and supply chain risk into the same catalogue as access control. Physical protection and contingency planning are long-standing information security families.

Source: NIST SP 800-53 Rev. 5 (NIST) — SP 800-53 Rev. 5 > Control Families