Study. uk . com
  1. Home
  2. All questions
  3. Question 403

CISSP study material · question 403 of 500

An organisation wants its assessment reports to distinguish a minor documentation gap from a control that is entirely absent. What does SP 800-53A permit?

  1. Subdividing other-than-satisfied findings by severity or criticality and the adverse effect on operations.
  2. Excluding minor findings from the report at the assessor's discretion.
  3. Introducing a partially satisfied score between the two existing values.
  4. Recording the documentation gap as satisfied with an observation attached.
Show the answer

Answer: A. Subdividing other-than-satisfied findings by severity or criticality and the adverse effect on operations.

SP 800-53A says organisations may choose to define subcategories of other-than-satisfied findings indicating the severity or criticality of the weaknesses and their potential adverse effects.

Source: NIST SP 800-53A Rev. 5 (NIST) — SP 800-53A Rev. 5 > 3.3 Conduct Security and Privacy Control Assessments

Challenge yourself on this topic → Study as cards