CGRC · Question #480
NIST SP 800-53 describes a family of controls as: Response:
The correct answer is A. A grouping of like controls covering the same subject. NIST SP 800-53 describes a family of controls as a grouping of like controls that cover the same subject area within information security.
Question
NIST SP 800-53 describes a family of controls as:
Response:
Options
- AA grouping of like controls covering the same subject
- BA grouping of interoperating controls from all three classes of controls
- CA grouping of controls that when applied provides a complete protection package for a single
- DA grouping of control tests from NIST SP 800-53A that corresponds to a class of controls in NIST
How the community answered
(42 responses)- A93% (39)
- B5% (2)
- D2% (1)
Why each option
NIST SP 800-53 describes a family of controls as a grouping of like controls that cover the same subject area within information security.
NIST SP 800-53 organizes security controls into "families," where each family consists of controls that share a common security objective or subject area, such as Access Control (AC) or Audit and Accountability (AU). This organization helps in categorizing and managing controls systematically to ensure comprehensive security coverage across different facets of an information system.
While controls often interoperate, a family is defined by its common subject area, not necessarily by interoperation across all three classes of controls (technical, operational, management).
This definition is too broad and does not accurately capture the specific NIST concept of a "family" as a subject-based grouping of controls.
Control tests from NIST SP 800-53A are for assessing controls, and a "family" refers to a grouping of the controls themselves, not their tests or corresponding classes.
Concept tested: NIST SP 800-53 control families
Source: csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
Topics
Community Discussion
No community discussion yet for this question.