CGRC · Question #724
When SCA conducted assessments are conducted in parallel with system development/acquisition & implementation; it "does not" permit early identification of weaknesses & cost-effective corrective…
The correct answer is B. False. This question evaluates understanding of the benefits of conducting security assessments early and in parallel with system development.
Question
When SCA conducted assessments are conducted in parallel with system development/acquisition & implementation; it "does not" permit early identification of weaknesses & cost-effective corrective action; True or False? Response:
Options
- ATrue
- BFalse
How the community answered
(64 responses)- A13% (8)
- B88% (56)
Why each option
This question evaluates understanding of the benefits of conducting security assessments early and in parallel with system development.
The statement is false because early security assessments during development precisely enable prompt identification of weaknesses and more cost-effective remediation, preventing expensive retrofits later.
Conducting Security Control Assessor (SCA) assessments concurrently with system development and implementation is a best practice. This approach allows for the early identification of security weaknesses, enabling more efficient and cost-effective corrective actions before issues become deeply integrated and expensive to fix later in the system's lifecycle.
Concept tested: Benefits of early security assessment in SDLC
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Topics
Community Discussion
No community discussion yet for this question.