CGRC · Question #123
Which of the following control families belongs to the management class of security controls? Response:
The correct answer is A. System & Service Acquisition. The System & Service Acquisition control family belongs to the management class of security controls, focusing on the organizational policies and processes for acquiring and managing IT systems.
Question
Which of the following control families belongs to the management class of security controls? Response:
Options
- ASystem & Service Acquisition
- BAccess Control
- CConfiguration management
- DMedia Protection
How the community answered
(25 responses)- A96% (24)
- B4% (1)
Why each option
The System & Service Acquisition control family belongs to the management class of security controls, focusing on the organizational policies and processes for acquiring and managing IT systems.
NIST's security control families are categorized into three classes: Management, Operational, and Technical. System and Service Acquisition (SA) is explicitly a management control family, dealing with the organizational processes and policies for acquiring, developing, and maintaining systems and services.
Access Control (AC) is a technical control family, focusing on regulating who or what can access a system or its resources.
Configuration Management (CM) is an operational control family, dealing with establishing and maintaining consistent baselines for system configurations.
Media Protection (MP) is an operational control family, focusing on protecting information system media throughout its lifecycle.
Concept tested: NIST control families and classes
Source: https://csrc.nist.gov/pubs/sp/800/53/r5/archive/toc
Topics
Community Discussion
No community discussion yet for this question.