CGRC · Question #75
When carrying out ongoing risk response, the effectiveness of new, modified, enhanced, or added controls must be... Response:
The correct answer is B. Reassessed. During ongoing risk response, the effectiveness of any new or changed security controls must be reassessed to ensure they adequately address identified risks. This re-evaluation confirms their continued efficacy in the evolving threat landscape.
Question
When carrying out ongoing risk response, the effectiveness of new, modified, enhanced, or added controls must be... Response:
Options
- AVerified
- BReassessed
- CExamined
- DTested
How the community answered
(32 responses)- B91% (29)
- C6% (2)
- D3% (1)
Why each option
During ongoing risk response, the effectiveness of any new or changed security controls must be reassessed to ensure they adequately address identified risks. This re-evaluation confirms their continued efficacy in the evolving threat landscape.
"Verified" is a step within assessment but "reassessed" encompasses the full evaluation of effectiveness in the context of ongoing risk management.
When new, modified, enhanced, or added controls are implemented as part of ongoing risk response, their effectiveness must be reassessed. This reassessment ensures that the controls are functioning as intended and continue to mitigate the associated risks effectively within the system's operational environment.
"Examined" is too general; reassessment specifically implies evaluating effectiveness against original objectives or updated risks.
"Tested" is a part of reassessment, but reassessment is the broader concept of re-evaluating the overall effectiveness of the control in its operational context.
Concept tested: RMF - Continuous Monitoring and Control Reassessment
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf
Topics
Community Discussion
No community discussion yet for this question.