Study. uk . com
  1. Home
  2. All questions
  3. Question 61

CISSP study material · question 61 of 500

A programme manager schedules the security control assessment for a new claims system as a single event in the week before the authorisation decision, arguing that any earlier assessment would examine an unfinished system. The assessment lead pushes back. Which correction should the lead offer?

  1. Assessment should move earlier still and replace the authorisation decision with evidence gathered during design
  2. Assessment belongs at several points across the development life cycle rather than only at the authorisation decision
  3. Assessment should repeat only when a significant change is made after the system has entered production
  4. Assessment timing here is sound, provided continuous monitoring starts the day the system enters production
Show the answer

Answer: B. Assessment belongs at several points across the development life cycle rather than only at the authorisation decision

Control assessment is expected at multiple life-cycle points so defects surface while remediation is cheap; a single pre-authorisation event guarantees late, costly findings.

Source: NIST SP 800-53A Rev. 5 (NIST) — SP 800-53A Rev. 5 > Abstract

Challenge yourself on this topic → Study as cards