What ensures that the control mechanisms correctly implement the security policy for the entire life cycle of an information system?

Question

Options

• AAccountability controls
• BMandatory access controls
• CAssurance procedures
• DAdministrative controls

• A
  6% (2)
• B
  3% (1)
• C
  91% (29)

Explanation

Assurance procedures are the mechanisms that verify and validate - throughout an entire system's life cycle - that security controls are correctly implementing the intended security policy. They provide confidence (assurance) that a system does what it's supposed to do, from design through decommission.

Why the distractors are wrong:

• A. Accountability controls track and audit user actions (who did what), but don't verify that policy is correctly enforced by the system itself.
• B. Mandatory access controls (MAC) are an access enforcement mechanism, not a verification mechanism - they implement one aspect of policy rather than validating the whole policy lifecycle.
• D. Administrative controls are procedural/organizational measures (policies, training, procedures) that govern behavior, not mechanisms that validate correct policy implementation over a system's life cycle.

Memory tip: Think of assurance as the "quality guarantee" - just as a product warranty assures a product works as intended over its lifetime, assurance procedures guarantee a security system correctly enforces its policy from cradle to grave. If you see "verify/validate/confirm correct implementation over lifecycle," think assurance.

No community discussion yet for this question.