CGRC · Question #619
What are the three primary considerations for defining system boundaries? Response:
The correct answer is A. 1. Normally be under the same direct management control. One primary consideration for defining system boundaries is that the system components should normally be under the same direct management control. This criterion helps to ensure consistent application of security policies and accountability within the system's scope.
Question
What are the three primary considerations for defining system boundaries? Response:
Options
- A
- Normally be under the same direct management control.
- B
- Abnormally be under the same direct management control.
- C
- Normally be under the same indirect management control.
- D
- Normally be under the same direct management control.
How the community answered
(33 responses)- A91% (30)
- B6% (2)
- C3% (1)
Why each option
One primary consideration for defining system boundaries is that the system components should normally be under the same direct management control. This criterion helps to ensure consistent application of security policies and accountability within the system's scope.
A fundamental consideration when defining system boundaries is that the components within the boundary are typically under the same direct management control. This criterion helps delineate which assets and operations are consistently governed by the same security policies and processes, simplifying risk management and oversight.
System components being "abnormally" under the same direct management control is not a standard or logical consideration for defining boundaries.
Components being under "indirect" management control suggests a less unified approach to security, which complicates boundary definition and direct security responsibility.
This choice is identical to A in its provided text and therefore represents the same correct consideration for defining system boundaries.
Concept tested: NIST RMF system boundary definition
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Topics
Community Discussion
No community discussion yet for this question.