CGRC · Question #718
An organizational official responsible for the development, implementation, assessment, and monitoring of security controls inherited by information systems is called... Response:
The correct answer is C. Common Control Provider (CCP). A Common Control Provider (CCP) is an organizational official responsible for developing, implementing, assessing, and monitoring security controls inherited by other information systems.
Question
An organizational official responsible for the development, implementation, assessment, and monitoring of security controls inherited by information systems is called... Response:
Options
- AInformation System Security Engineer (ISSE)
- BInformation System Owner (ISO)
- CCommon Control Provider (CCP)
- DChief Information Officer (CIO)
How the community answered
(28 responses)- A4% (1)
- C93% (26)
- D4% (1)
Why each option
A Common Control Provider (CCP) is an organizational official responsible for developing, implementing, assessing, and monitoring security controls inherited by other information systems.
An ISSE focuses on designing, developing, and implementing secure systems, but not specifically on managing inherited common controls across various systems as a provider.
An Information System Owner (ISO) is responsible for the overall system, including its security, but not specifically for providing common controls for other systems to inherit.
A Common Control Provider (CCP) is an organizational official or entity responsible for the development, implementation, assessment, and monitoring of common security controls that are inherited by multiple information systems. This role ensures consistent application and management of shared security services across the organization.
A Chief Information Officer (CIO) holds executive responsibility for IT, but typically delegates the specific operational management of common controls to a CCP.
Concept tested: Common Control Provider role
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Topics
Community Discussion
No community discussion yet for this question.