What significant change was made regarding security control selection in the revision of SP 800-37?

What significant change was made regarding security control selection in the revision of SP 800-37?

• A. The process was expanded to 12 steps
• B. Re-authorization every 3 years was eliminated
• C. Added annual reviews of security controls
• D. Increased the number of security controls required

Answer: (B)

The revision of SP 800-37 introduced important updates to the process of security control selection, but the correct answer highlights the notable change concerning re-authorization periods. The updated guidance emphasizes a streamlined approach to security assessments and management, which supports a more flexible framework where continuous monitoring is encouraged. By eliminating the strict requirement for re-authorization every three years, the revised document reflects a transition towards more adaptive security practices. This shift recognizes that ongoing security assessments and real-time monitoring can provide a more accurate reflection of an organization's security posture without the need for rigid adherence to a fixed re-authorization timeline. This change aligns with the goal of integrating security into the overall risk management framework, allowing organizations to focus on maintaining and improving security implementations continuously. It leads to a more efficient process that better accommodates the dynamic nature of technological environments and emerging threats.

The revision of SP 800-37 introduced important updates to the process of security control selection, but the correct answer highlights the notable change concerning re-authorization periods. The updated guidance emphasizes a streamlined approach to security assessments and management, which supports a more flexible framework where continuous monitoring is encouraged.

By eliminating the strict requirement for re-authorization every three years, the revised document reflects a transition towards more adaptive security practices. This shift recognizes that ongoing security assessments and real-time monitoring can provide a more accurate reflection of an organization's security posture without the need for rigid adherence to a fixed re-authorization timeline.

This change aligns with the goal of integrating security into the overall risk management framework, allowing organizations to focus on maintaining and improving security implementations continuously. It leads to a more efficient process that better accommodates the dynamic nature of technological environments and emerging threats.