Study. uk . com
  1. Home
  2. All questions
  3. Question 68

CISSP study material · question 68 of 500

Mission owners at a manufacturer keep deferring maintenance windows because downtime costs production, while the technology owners want fixes applied promptly. The chief information security officer needs a framing that settles the standing disagreement about whether patching is worth its cost. Which approach should be adopted?

  1. Escalate every deferred patch as a policy exception carrying executive sign-off and a risk acceptance
  2. Move patch decisions wholly to the technology owners so the mission owners are no longer consulted
  3. Present patching as routine preventive maintenance, budgeted and scheduled like other planned upkeep
  4. Substitute compensating network controls for scheduled patching until an outage window is agreed
Show the answer

Answer: C. Present patching as routine preventive maintenance, budgeted and scheduled like other planned upkeep

The real obstacle is disagreement between mission and technology owners over patching's worth; framing it as preventive maintenance makes its cost planned and expected rather than an argued exception.

Source: NIST SP 800-40 Rev. 4 (NIST) — SP 800-40 Rev. 4 > Abstract

Challenge yourself on this topic → Study as cards