nerdexam
(ISC)2

CGRC · Question #724

When SCA conducted assessments are conducted in parallel with system development/acquisition & implementation; it "does not" permit early identification of weaknesses & cost-effective corrective…

The correct answer is B. False. This question evaluates understanding of the benefits of conducting security assessments early and in parallel with system development.

Assessment/Audit of Security and Privacy Controls

Question

When SCA conducted assessments are conducted in parallel with system development/acquisition & implementation; it "does not" permit early identification of weaknesses & cost-effective corrective action; True or False? Response:

Options

  • ATrue
  • BFalse

How the community answered

(64 responses)
  • A
    13% (8)
  • B
    88% (56)

Why each option

This question evaluates understanding of the benefits of conducting security assessments early and in parallel with system development.

ATrue

The statement is false because early security assessments during development precisely enable prompt identification of weaknesses and more cost-effective remediation, preventing expensive retrofits later.

BFalseCorrect

Conducting Security Control Assessor (SCA) assessments concurrently with system development and implementation is a best practice. This approach allows for the early identification of security weaknesses, enabling more efficient and cost-effective corrective actions before issues become deeply integrated and expensive to fix later in the system's lifecycle.

Concept tested: Benefits of early security assessment in SDLC

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf

Topics

#Security Control Assessment (SCA)#SDLC Integration#Early Weakness Identification#Cost-effective Remediation

Community Discussion

No community discussion yet for this question.

Full CGRC Practice