Which of the following principles are defined by the IATF model? Each correct answer represents a complete solution. Choose all that apply.

Question

Options

• AThe degree to which the security of the system, as it is defined, designed, and implemented,
• BThe problem space is defined by the customer's mission or business needs.
• CThe systems engineer and information systems security engineer define the solution space,
• DAlways keep the problem and solution spaces separate.

• A
  26% (6)
• B
  74% (17)

Explanation

The IATF (Information Assurance Technical Framework) model is built around the separation of problem space and solution space: the customer's mission or business needs define what must be protected (B), while systems engineers and ISSEs define how to protect it through the solution space (C), and critically, these two spaces must always be kept distinct to prevent solution bias from distorting the requirements (D).

Option A is incorrect because it describes a definition of security assurance (the degree to which security is defined, designed, and implemented correctly) - a concept associated with frameworks like Common Criteria - not a named IATF model principle.

Memory tip: Think of IATF as a "two-room house" - the customer furnishes the Problem Room (needs/mission), the engineer designs the Solution Room (technical controls), and there's a strict "no mixing" rule between rooms. If an answer describes assurance levels or degrees of implementation correctness, it belongs in a different framework's house.

No community discussion yet for this question.