CISSP-ISSEP: Information Systems Security Engineering Professional

Question

Della is a security engineer for BlueWell Inc. She wants to implement configuration-management and control procedures that document proposed or actual changes to the information system. Which phase of the NIST SP 800-37 C&A methodology defines this task?

Explanation

The Continuous Monitoring phase includes configuration management and control. Its objective is to document proposed or actual changes to the information system and determine the effect of those changes on system security.

Learn more

NIST SP 800-37: Guide for the Security Certification and Accreditation of Federal Information Systems

CISSP-ISSEP: Information Systems Security Engineering Professional

AstroTutor

Notes

Readiness

QuestionQ170

Community Discussion