CGRC · Question #78
An assessment procedure consists of a set of which things, each with an associated set of potential assessment methods and assessment objects? Response:
The correct answer is A. Assessment objectives. An assessment procedure is composed of a set of assessment objectives, which specify what needs to be evaluated. Each objective is then linked to potential assessment methods and specific assessment objects to facilitate the evaluation.
Question
An assessment procedure consists of a set of which things, each with an associated set of potential assessment methods and assessment objects? Response:
Options
- AAssessment objectives
- BSecurity controls
- COperational requirements
- DAssessment objects
How the community answered
(21 responses)- A95% (20)
- B5% (1)
Why each option
An assessment procedure is composed of a set of assessment objectives, which specify what needs to be evaluated. Each objective is then linked to potential assessment methods and specific assessment objects to facilitate the evaluation.
According to NIST SP 800-53A, an assessment procedure consists of a set of assessment objectives, each detailing what needs to be verified or validated. These objectives are then paired with various assessment methods (e.g., examine, interview, test) and specific assessment objects (e.g., documents, personnel, system components) to achieve the assessment goals.
Security controls are what are being assessed, not the components of the assessment procedure itself.
Operational requirements define what the system must do, not the structure of an assessment procedure.
Assessment objects are the things being examined or tested, but the procedure is built around fulfilling *objectives*.
Concept tested: NIST Security Assessment Procedure Components
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar5.pdf
Topics
Community Discussion
No community discussion yet for this question.