Study. uk . com
  1. Home
  2. All questions
  3. Question 60

CISSP study material · question 60 of 500

A government contractor runs the same exhaustive assessment procedures against a public brochure website and against a system holding claimant medical records. Auditors report that the programme misapplies its own guidance. Which change brings the programme into line?

  1. Apply the deepest available procedure everywhere, so that evidence stays consistent across the system inventory
  2. Reduce every procedure to the shallowest depth and rely on continuous monitoring to reveal any shortfall
  3. Tailor each procedure so that assessment depth and coverage track the organisation's declared risk tolerance
  4. Leave depth to each assessor, who judges the rigour required from the findings as they emerge
Show the answer

Answer: C. Tailor each procedure so that assessment depth and coverage track the organisation's declared risk tolerance

Assessment procedures are tailored so rigour matches stated risk tolerance; uniform maximum depth burns effort on low-risk systems without improving the assurance they need.

Source: NIST SP 800-53A Rev. 5 (NIST) — SP 800-53A Rev. 5 > Abstract

Challenge yourself on this topic → Study as cards