nerdexam
(ISC)2

CGRC · Question #718

An organizational official responsible for the development, implementation, assessment, and monitoring of security controls inherited by information systems is called... Response:

The correct answer is C. Common Control Provider (CCP). A Common Control Provider (CCP) is an organizational official responsible for developing, implementing, assessing, and monitoring security controls inherited by other information systems.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

An organizational official responsible for the development, implementation, assessment, and monitoring of security controls inherited by information systems is called... Response:

Options

  • AInformation System Security Engineer (ISSE)
  • BInformation System Owner (ISO)
  • CCommon Control Provider (CCP)
  • DChief Information Officer (CIO)

How the community answered

(28 responses)
  • A
    4% (1)
  • C
    93% (26)
  • D
    4% (1)

Why each option

A Common Control Provider (CCP) is an organizational official responsible for developing, implementing, assessing, and monitoring security controls inherited by other information systems.

AInformation System Security Engineer (ISSE)

An ISSE focuses on designing, developing, and implementing secure systems, but not specifically on managing inherited common controls across various systems as a provider.

BInformation System Owner (ISO)

An Information System Owner (ISO) is responsible for the overall system, including its security, but not specifically for providing common controls for other systems to inherit.

CCommon Control Provider (CCP)Correct

A Common Control Provider (CCP) is an organizational official or entity responsible for the development, implementation, assessment, and monitoring of common security controls that are inherited by multiple information systems. This role ensures consistent application and management of shared security services across the organization.

DChief Information Officer (CIO)

A Chief Information Officer (CIO) holds executive responsibility for IT, but typically delegates the specific operational management of common controls to a CCP.

Concept tested: Common Control Provider role

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf

Topics

#Common Controls#Organizational Roles#Risk Management Framework (RMF)#Inherited Controls

Community Discussion

No community discussion yet for this question.

Full CGRC Practice