CISM · Question #38
The PRIMARY purpose for continuous monitoring of security controls is to ensure:
The correct answer is B. effectiveness of controls. The primary purpose of continuous monitoring of security controls is to ensure their ongoing effectiveness in protecting organizational assets against threats.
Question
The PRIMARY purpose for continuous monitoring of security controls is to ensure:
Options
- Aalignment with compliance requirements.
- Beffectiveness of controls.
- Ccontrol gaps are minimized.
- Dsystem availability.
How the community answered
(28 responses)- B89% (25)
- C7% (2)
- D4% (1)
Why each option
The primary purpose of continuous monitoring of security controls is to ensure their ongoing effectiveness in protecting organizational assets against threats.
While continuous monitoring aids in demonstrating compliance, its fundamental purpose is not merely alignment with requirements, but confirming actual operational effectiveness.
Continuous monitoring is implemented to regularly assess whether security controls are operating as intended and are still capable of mitigating risks effectively against evolving threats and changes in the environment. This ensures the controls maintain their protective function over time.
Minimizing control gaps is a result of identifying ineffective controls or new risks through monitoring, but the overarching goal is the effectiveness of the controls themselves.
System availability is one aspect that security controls protect, but it's not the primary purpose of monitoring the controls; rather, it's a desired outcome of effective controls.
Concept tested: Continuous security monitoring purpose
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-137.pdf
Topics
Community Discussion
No community discussion yet for this question.