What defines the three levels of baseline controls for an information system?

What defines the three levels of baseline controls for an information system?

• A. Impact level
• B. Security assurance
• C. Common controls
• D. Assessment object

Answer: (A)

The correct answer focuses on the concept of impact levels, which are crucial for determining the baseline controls for an information system. The three levels of baseline controls—low, moderate, and high—are defined based on the potential impact that a security breach could have on the confidentiality, integrity, and availability of the information processed by that system. When assessing an information system, the identified impact level helps organizations tailor their security controls to adequately mitigate risks associated with the specific sensitivity of the data being handled. For example, a system that handles highly sensitive information will require more stringent controls than one that processes low-impact data. This risk-based approach aligns with federal guidelines and frameworks, which stress the importance of matching controls with the inherent risks of the system based on its impact level. The other options do not directly define the three levels of baseline controls. Security assurance relates to the confidence in the security measures' effectiveness, common controls refer to security controls that can be shared across multiple systems, and assessment objects pertain to what is being evaluated during a security assessment. These concepts are relevant within the broader context of information security but do not specifically delineate the baseline control levels established by impact assessments.

The correct answer focuses on the concept of impact levels, which are crucial for determining the baseline controls for an information system. The three levels of baseline controls—low, moderate, and high—are defined based on the potential impact that a security breach could have on the confidentiality, integrity, and availability of the information processed by that system.

When assessing an information system, the identified impact level helps organizations tailor their security controls to adequately mitigate risks associated with the specific sensitivity of the data being handled. For example, a system that handles highly sensitive information will require more stringent controls than one that processes low-impact data. This risk-based approach aligns with federal guidelines and frameworks, which stress the importance of matching controls with the inherent risks of the system based on its impact level.

The other options do not directly define the three levels of baseline controls. Security assurance relates to the confidence in the security measures' effectiveness, common controls refer to security controls that can be shared across multiple systems, and assessment objects pertain to what is being evaluated during a security assessment. These concepts are relevant within the broader context of information security but do not specifically delineate the baseline control levels established by impact assessments.