Study. uk . com
  1. Home
  2. All questions
  3. Question 404

CISSP study material · question 404 of 500

Why does SP 800-53A place organisation-defined parameters first among a control's determination statements?

  1. So the parameters can be inherited from a common control provider.
  2. So that parameters may be scored separately from the control itself.
  3. So the parameters can be assessed without reading the rest of the control.
  4. So the assessor can quickly see whether the organisation actually defined the assignments and selections the control leaves open.
Show the answer

Answer: D. So the assessor can quickly see whether the organisation actually defined the assignments and selections the control leaves open.

Organisation-defined parameters are listed first and separately, each with a unique identifier, to let the assessor quickly determine whether the organisation defined or selected them.

Source: NIST SP 800-53A Rev. 5 (NIST) — SP 800-53A Rev. 5 > 2.4.3 Assessment Objectives

Challenge yourself on this topic → Study as cards