nerdexam
(ISC)2

CGRC · Question #492

NIST SP 800-64 Rev 2 has been withdrawn but security professionals can still find guidance on system development lifecycle in which Publication? Response:

The correct answer is B. NIST SP 800-160. NIST SP 800-160, "Systems Security Engineering," provides comprehensive guidance on integrating security into the system development lifecycle (SDLC), replacing withdrawn publications like SP 800-64. This publication emphasizes a systems security engineering approach throughout…

Security and Privacy Governance, Risk Management, and Compliance Program

Question

NIST SP 800-64 Rev 2 has been withdrawn but security professionals can still find guidance on system development lifecycle in which Publication? Response:

Options

  • ANIST SP 800-53
  • BNIST SP 800-160
  • CNIST SP 800-60
  • DNIST SP 800-59

How the community answered

(57 responses)
  • B
    95% (54)
  • C
    2% (1)
  • D
    4% (2)

Why each option

NIST SP 800-160, "Systems Security Engineering," provides comprehensive guidance on integrating security into the system development lifecycle (SDLC), replacing withdrawn publications like SP 800-64. This publication emphasizes a systems security engineering approach throughout the entire lifecycle for trustworthiness.

ANIST SP 800-53

NIST SP 800-53 focuses on security and privacy controls for information systems and organizations, not primarily on the system development lifecycle guidance itself.

BNIST SP 800-160Correct

NIST SP 800-160 series, specifically Volume 1 and 2, offers detailed guidance on incorporating security engineering principles throughout the system development lifecycle, effectively replacing and expanding upon the concepts previously found in NIST SP 800-64. It focuses on integrating security considerations from the earliest stages of system design and development to ensure trustworthiness.

CNIST SP 800-60

NIST SP 800-60 addresses mapping types of information and information systems to security categories, which is distinct from system development lifecycle guidance.

DNIST SP 800-59

NIST SP 800-59 provides guidance on the guideline for identifying an information system as a national security system, not general SDLC security guidance.

Concept tested: NIST SP 800-160, SDLC security guidance

Source: https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final

Topics

#NIST Special Publications#System Development Lifecycle (SDLC)#System Security Engineering#Information Security Guidance

Community Discussion

No community discussion yet for this question.

Full CGRC Practice