SSCP · Question #1116
Which auditing practice relates to the controlling of hardware, software, firmware, and documentation to insure it has not been improperly modified?
The correct answer is B. Configuration Control. Configuration control is an auditing practice focused on managing and documenting changes to system components to ensure their integrity and prevent unauthorized modifications.
Question
Which auditing practice relates to the controlling of hardware, software, firmware, and documentation to insure it has not been improperly modified?
Options
- ASystem Control
- BConfiguration Control
- CConsequence Assessment
- DCertification / Accreditation
How the community answered
(23 responses)- A4% (1)
- B91% (21)
- D4% (1)
Why each option
Configuration control is an auditing practice focused on managing and documenting changes to system components to ensure their integrity and prevent unauthorized modifications.
System Control is a general term that doesn't specifically address the auditing and modification prevention of system components and documentation.
Configuration Control involves establishing and maintaining consistency of a product's attributes throughout its life cycle, specifically managing changes to hardware, software, firmware, and documentation to prevent improper modification and maintain system integrity. This practice ensures that all components remain in their approved and secure state.
Consequence Assessment focuses on evaluating the potential impact of an event rather than controlling the integrity of system components.
Certification / Accreditation refers to a formal process of evaluating and approving a system's security posture, not the ongoing control of its components.
Concept tested: Auditing configuration management
Source: https://csrc.nist.gov/glossary/term/configuration_control
Topics
Community Discussion
No community discussion yet for this question.