nerdexam
(ISC)2

CGRC · Question #712

An official authorization decision that allows for a single authorization package to be developed for an archetype (i.e., common) version of a system. This best defines which of the follwing…

The correct answer is B. Type authorization. Type authorization enables the use of a single authorization package for an archetype or common version of an information system, promoting efficiency across similar systems.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

An official authorization decision that allows for a single authorization package to be developed for an archetype (i.e., common) version of a system. This best defines which of the follwing authorizations? Response:

Options

  • AAuthorization to test
  • BType authorization
  • CFacility authorization
  • DTraditional authorization

How the community answered

(18 responses)
  • A
    6% (1)
  • B
    89% (16)
  • C
    6% (1)

Why each option

Type authorization enables the use of a single authorization package for an archetype or common version of an information system, promoting efficiency across similar systems.

AAuthorization to test

Authorization to test is a preliminary step allowing system testing, not a full system authorization for an archetype.

BType authorizationCorrect

Type authorization refers to an official decision that allows a single authorization package to be developed and applied to an archetype or common version of an information system, enabling reuse and efficiency across similar systems. This approach reduces redundant authorization efforts for identical system types.

CFacility authorization

Facility authorization pertains to the authorization of physical facilities, not information systems.

DTraditional authorization

Traditional authorization implies a one-off authorization for a specific system, not an authorization for an archetype or common version.

Concept tested: Authorization types in cybersecurity

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf

Topics

#Type authorization#Authorization decision#Risk management#Common systems

Community Discussion

No community discussion yet for this question.

Full CGRC Practice