Study. uk . com
  1. Home
  2. All questions
  3. Question 4

CISSP study material · question 4 of 500

A manufacturer is standing up the Risk Management Framework for the first time. The security lead proposes to begin by categorising the first system in scope, while the enterprise architect argues that organisational groundwork must come first. Which activity does the framework place ahead of categorisation?

  1. A continuous monitoring programme that must reach steady state before categorisation begins
  2. A preparatory step that readies the organisation and its systems to execute the framework
  3. An authorisation decision that grants provisional approval while categorisation is completed
  4. A control assessment that establishes the baseline the organisation will later categorise against
Show the answer

Answer: B. A preparatory step that readies the organisation and its systems to execute the framework

Revision 2 added a Prepare step so the organisation is ready before any system is categorised; assessment and authorisation come later, and monitoring follows control implementation.

Source: NIST SP 800-37 Rev. 2 (NIST) — SP 800-37 Rev. 2 > Abstract

Challenge yourself on this topic → Study as cards