Study. uk . com
  1. Home
  2. All questions
  3. Question 81

CompTIA Security+ study material · question 81 of 611

A team applies a NIST control baseline exactly as published with no changes. What have they misunderstood?

  1. Baselines are mandatory and may not be changed
  2. Baselines apply only to privacy controls
  3. Baselines are starting points chosen by impact level and are expected to be tailored
  4. Baselines must be replaced by an overlay before use
Show the answer

Answer: C. Baselines are starting points chosen by impact level and are expected to be tailored

Baselines are a starting set for an impact level. Tailoring adapts them to the system's actual context.

Source: NIST SP 800-53 Rev. 5 (NIST) — SP 800-53r5 › Control Baselines

Challenge yourself on this topic → Study as cards