Study. uk . com
  1. Home
  2. All questions
  3. Question 90

CISSP study material · question 90 of 500

A shared hosting platform provides physical, environmental and network controls that thirty tenant systems inherit without implementing them. Who is accountable for developing, assessing and monitoring those inherited controls?

  1. The authorising official for the largest tenant system.
  2. The organisation's risk executive function.
  3. Each tenant system's own system owner.
  4. The common control provider.
Show the answer

Answer: D. The common control provider.

A common control provider is the official responsible for controls other systems inherit. System owners remain responsible for their own controls, and the risk executive gives oversight, not ownership.

Source: NIST SP 800-39 (NIST) — SP 800-39 > 2.3.2 footnote 25

Challenge yourself on this topic → Study as cards