Study. uk . com
  1. Home
  2. All questions
  3. Question 391

CISSP study material · question 391 of 500

An agency schedules its security control testing every eighteen months. What frequency does federal law require, as cited in SP 800-115?

  1. Every eighteen months, which the schedule already meets.
  2. Only when a significant change to the system occurs.
  3. A frequency depending on risk, but no less than annually.
  4. Quarterly, regardless of risk.
Show the answer

Answer: C. A frequency depending on risk, but no less than annually.

SP 800-115 cites the statutory requirement for periodic testing and evaluation of security policies, procedures and practices at a frequency depending on risk but no less than annually.

Source: NIST SP 800-115 (NIST) — SP 800-115 > 2. footnote 1

Challenge yourself on this topic → Study as cards