CISA · Question #64
An organization that has decided to approve the use of end-user computing (EUC) should FIRST ensure:
The correct answer is A. an EUC policy is developed. When an organization decides to approve end-user computing (EUC), the first action should be to develop a comprehensive EUC policy.
Question
An organization that has decided to approve the use of end-user computing (EUC) should FIRST ensure:
Options
- Aan EUC policy is developed.
- BEUC controls are reviewed.
- Ca business impact analysis (BIA) is conducted.
- DEUC use cases are assessed and documented.
How the community answered
(61 responses)- A90% (55)
- B5% (3)
- C3% (2)
- D2% (1)
Why each option
When an organization decides to approve end-user computing (EUC), the first action should be to develop a comprehensive EUC policy.
Developing an EUC policy is the foundational step as it establishes the rules, responsibilities, and guidelines for how EUC will be managed, secured, and supported within the organization. This policy provides the necessary framework and context for all subsequent actions, including control reviews, risk assessments, and documentation of use cases.
Reviewing EUC controls cannot effectively occur without an established policy that defines what controls are necessary and against what standards they should be measured.
Concept tested: End-user computing (EUC) governance
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
Topics
Community Discussion
No community discussion yet for this question.