CGRC · Question #468
A part of tailoring guidance providing organizations with specific policy/regulatory -related, technology-related, system component allocation-related, operational/environmental-related, physical…
The correct answer is A. Scoping Guidance. Scoping guidance defines the applicability and boundaries of security controls for a specific system, considering various contextual factors.
Question
A part of tailoring guidance providing organizations with specific policy/regulatory -related, technology-related, system component allocation-related, operational/environmental-related, physical infrastructure-related, public access-related, scalability- related, common control-related, and security objective- related considerations on the applicability and implementation of individual security controls in the security control baseline. Response:
Options
- AScoping Guidance
- BTailoring Guidance
- CEruption Guidance
- DEducation Guidance
How the community answered
(30 responses)- A90% (27)
- C3% (1)
- D7% (2)
Why each option
Scoping guidance defines the applicability and boundaries of security controls for a specific system, considering various contextual factors.
Scoping guidance involves defining the applicability and boundaries of security controls to a specific system or environment, considering factors like policy, technology, operational environment, and public access, as detailed in the description.
Tailoring guidance is a broader concept that includes scoping, supplementing, and customizing controls, while scoping is the specific aspect described.
Eruption Guidance is not a recognized term in NIST or information security risk management frameworks.
Education Guidance refers to advice or programs related to security awareness and training, not the process of defining control applicability.
Concept tested: NIST RMF Tailoring Guidance - Scoping
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar5.pdf
Topics
Community Discussion
No community discussion yet for this question.