nerdexam
(ISC)2

CGRC · Question #383

_________________________ management offers a structured approach to managing, approving, and documenting changes affecting an IS; critical to continuous assessment of security posture of IS…

The correct answer is A. Configuration. Configuration management provides a structured approach to control and document changes to an Information System (IS), which is crucial for continuously assessing its security posture.

Compliance Maintenance

Question

_________________________ management offers a structured approach to managing, approving, and documenting changes affecting an IS; critical to continuous assessment of security posture of IS. Response:

Options

  • AConfiguration
  • BInformation
  • COperation
  • DOrganization

How the community answered

(32 responses)
  • A
    91% (29)
  • B
    6% (2)
  • D
    3% (1)

Why each option

Configuration management provides a structured approach to control and document changes to an Information System (IS), which is crucial for continuously assessing its security posture.

AConfigurationCorrect

Configuration management is the process of establishing and maintaining consistency of a product's performance, functional, and physical attributes with its requirements, design, and operational information throughout its life. This disciplined approach ensures that all changes affecting an IS are managed, approved, and documented, which is fundamental for understanding and maintaining the security baseline and supporting continuous security assessment.

BInformation

Information management deals with the collection, storage, curation, dissemination, archiving, and deletion of information, which is broader than specific changes to an IS's configuration.

COperation

Operation management focuses on the daily functioning and efficiency of systems and processes, rather than the structured control and documentation of changes themselves.

DOrganization

Organization management refers to the overall process of planning, organizing, leading, and controlling resources within an organization to achieve its goals, which is too general for managing IS changes.

Concept tested: Information system change management

Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-128.pdf

Topics

#Configuration Management#Change Management#IS Security#Continuous Monitoring

Community Discussion

No community discussion yet for this question.

Full CGRC Practice