nerdexam
(ISC)2

CGRC · Question #101

An authorization approach where a single organizational official in a senior leadership position is responsible and accountable for a system or common controls is referred to as: Response:

The correct answer is B. Traditional authorization. This question describes a "traditional authorization" approach where a single senior official holds responsibility and accountability for system authorization.

Selection and Approval of Framework, Security, and Privacy Controls

Question

An authorization approach where a single organizational official in a senior leadership position is responsible and accountable for a system or common controls is referred to as:

Response:

Options

  • AJoint authorization
  • BTraditional authorization
  • CSite authorization
  • DSingle authorization

How the community answered

(41 responses)
  • A
    7% (3)
  • B
    88% (36)
  • C
    2% (1)
  • D
    2% (1)

Why each option

This question describes a "traditional authorization" approach where a single senior official holds responsibility and accountability for system authorization.

AJoint authorization

Joint authorization involves multiple authorizing officials sharing responsibility for a system, which contradicts the "single official" description.

BTraditional authorizationCorrect

Traditional authorization involves a single authorizing official (AO) taking full responsibility for the security posture and authorization decision of an information system or its common controls. This approach consolidates accountability under one senior leader, fitting the description of a single organizational official.

CSite authorization

Site authorization typically refers to authorizing a group of systems at a specific location, not necessarily the structure of accountability by a single official.

DSingle authorization

Single authorization is a term that could be confused with traditional authorization but is not the established terminology in cybersecurity frameworks like NIST RMF for this specific approach.

Concept tested: Authorization approaches and AO responsibility.

Source: https://csrc.nist.gov/glossary/term/authorizing_official

Topics

#Authorization Models#Authorizing Official (AO)#NIST RMF#Traditional Authorization

Community Discussion

No community discussion yet for this question.

Full CGRC Practice