According to NIST SP 800-37,which of the following is the first step in the security controls selection process?
A) Categorize the information system and the information processed
B) Select an initial set of baseline security controls
C) Assess the security controls using appropriate assessment procedures
D) Authorize information system operation based on risk determination

Question

Quizplus · Accepted Answer

According to NIST SP 800-37, the first step in the security controls selection process is to categorize the information system and the information processed. This step involves identifying the system's information and the information's impact on the organization's mission, goals, and objectives, as well as the sensitivity, criticality, and confidentiality of the information. Only after this first step can the appropriate set of baseline security controls be selected.

According to NIST SP 800-37,which of the Following Is the First