Study. uk . com
  1. Home
  2. All questions
  3. Question 455

CISSP study material · question 455 of 500

A system categorised low impact under FIPS 199 has no alternate site strategy, and an auditor records this as a deficiency. What does NIST SP 800-34 actually require?

  1. An alternate site strategy is required wherever the recovery time objective is under 24 hours.
  2. An alternate site strategy is required for every categorised system regardless of impact.
  3. An alternate site strategy is expected for moderate and high impact systems; extending it to low impact ones is an organisational choice.
  4. An alternate site strategy is required only for high impact systems.
Show the answer

Answer: C. An alternate site strategy is expected for moderate and high impact systems; extending it to low impact ones is an organisational choice.

For every moderate or high impact system the plan should cover recovery at an alternate facility; considering low impact systems is an organisational decision.

Source: NIST SP 800-34 Rev. 1 (NIST) — SP 800-34 Rev. 1 > 3.4.3 Alternate Site

Challenge yourself on this topic → Study as cards