CGRC · Question #517
What is the purpose of the monitor step? Response:
The correct answer is C. To maintain an ongoing situational awareness about the security and privacy posture of the. The primary purpose of the monitor step in security frameworks is to maintain continuous situational awareness regarding the security and privacy posture of the system and organization.
Question
What is the purpose of the monitor step? Response:
Options
- AAll of the above
- BTo maintain the system in support of risk management decisions
- CTo maintain an ongoing situational awareness about the security and privacy posture of the
- DTo monitor changes in the system and the environment of operation
How the community answered
(30 responses)- A7% (2)
- C90% (27)
- D3% (1)
Why each option
The primary purpose of the monitor step in security frameworks is to maintain continuous situational awareness regarding the security and privacy posture of the system and organization.
While B and D are components or outcomes of the monitor step, option C is a more comprehensive and overarching purpose.
Maintaining the system in support of risk management decisions is an outcome of effective monitoring, not the primary purpose itself.
The 'Monitor' step (Step 6) of the NIST Risk Management Framework is designed to continuously monitor the security and privacy controls, the information system, and its environment of operation. This ongoing assessment helps maintain an up-to-date understanding of the system's risk posture and informs risk management decisions throughout the system's lifecycle.
Monitoring changes in the system and its environment of operation is a method or activity performed during the monitor step, but it serves the broader purpose of maintaining situational awareness.
Concept tested: Purpose of NIST RMF Monitor Step
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Topics
Community Discussion
No community discussion yet for this question.