nerdexam
(ISC)2

CGRC · Question #646

The National Institutes of Standards and Technology (NIST) guidance classifies security controls as? Response:

The correct answer is A. System-specific, Common and Hybrid. NIST guidance, particularly in frameworks like the Risk Management Framework (RMF), classifies security controls into three main categories: System-specific, Common, and Hybrid. This classification helps in determining the applicability and management of controls.

Selection and Approval of Framework, Security, and Privacy Controls

Question

The National Institutes of Standards and Technology (NIST) guidance classifies security controls as? Response:

Options

  • ASystem-specific, Common and Hybrid
  • BProduction, development, and test.
  • CPeople, process, and technology.
  • DTechnical, administrative, and program.

How the community answered

(30 responses)
  • A
    90% (27)
  • B
    3% (1)
  • C
    7% (2)

Why each option

NIST guidance, particularly in frameworks like the Risk Management Framework (RMF), classifies security controls into three main categories: System-specific, Common, and Hybrid. This classification helps in determining the applicability and management of controls.

ASystem-specific, Common and HybridCorrect

NIST SP 800-53 and SP 800-37 categorize security controls as System-specific (for a single system), Common (inherited by multiple systems), and Hybrid (partially common and partially system-specific). This classification is crucial for proper control selection and implementation.

BProduction, development, and test.

Production, development, and test are environments or stages of a system lifecycle, not classifications of security controls themselves.

CPeople, process, and technology.

People, process, and technology are foundational pillars of cybersecurity but are not the specific classifications NIST uses for security controls.

DTechnical, administrative, and program.

Technical, administrative, and program are common classifications for security controls, but NIST uses "System-specific, Common, and Hybrid" within the RMF context for categorization based on scope and inheritance.

Concept tested: NIST security control classification

Source: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

Topics

#NIST#Security Controls#Control Classification#NIST SP 800-53

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice