CGRC · Question #499
The use of automation to conduct security control assessments should be maximized to do the following except one. Response:
The correct answer is A. Enable authorizing official to have ready access to the current security state of the system and. Automation in security control assessments primarily increases the speed, efficiency, and frequency of assessments for continuous monitoring, but it does not directly enable the authorizing official to have ready access to the system's current security state. While automation aid
Question
The use of automation to conduct security control assessments should be maximized to do the following except one. Response:
Options
- AEnable authorizing official to have ready access to the current security state of the system and
- BIncrease the speed and overall effectiveness and efficiencies of assessments.
- CSupport ongoing monitoring of system security posture.
- DPermit increased frequency and volume of assessments consistent with the organization's
How the community answered
(48 responses)- A90% (43)
- B2% (1)
- C6% (3)
- D2% (1)
Why each option
Automation in security control assessments primarily increases the speed, efficiency, and frequency of assessments for continuous monitoring, but it does not directly enable the authorizing official to have ready access to the system's current security state. While automation aids in providing data, the AO's access is facilitated through reporting and dashboarding tools, not the automation process itself.
While automation can generate data that helps an AO understand the system's security state, the direct enablement of "ready access" to the current security state is more a function of reporting tools, dashboards, and organizational processes, rather than the automation of assessments itself. The primary benefits of automation are listed in the other options.
Automation significantly increases the speed, effectiveness, and efficiency of security control assessments by automating repetitive tasks and analysis.
Automated tools are crucial for supporting continuous or ongoing monitoring of a system's security posture by regularly checking controls.
Automation allows organizations to perform security assessments with greater frequency and across a larger volume of systems, aligning with continuous monitoring strategies.
Concept tested: Benefits of Security Automation, Authorization Official role
Source: https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final
Topics
Community Discussion
No community discussion yet for this question.