Question

Security control assessment tries to determine if the controls are:

a. producing desired results
b. compliant with fips 199
c. compliant with nist sp800-37
d. covered by fisma

Answer 1

A security control assessment evaluates if security controls are producing desired results, rather than just compliance with specific frameworks such as FIPS 199, NIST SP800-37, or FISMA.option c.

Step-by-step explanation:

A security control assessment is fundamentally designed to determine if the implemented controls within an information system are producing desired results. This involves evaluating the effectiveness of security measures to protect the system and data against threats and vulnerabilities.

Effectiveness is measured by seeing if the controls adequately prevent, detect, and respond to incidents that could compromise the system's security. While FIPS 199, NIST SP800-37, and FISMA provide frameworks and standards for cybersecurity, the assessment is not strictly about compliance with these protocols, but rather about the functionality and outcomes of the security controls in place.