How would you determine if an intrusion detection system is required or another supplemental control is sufficient?
A. General Service Administration (GSA) makes that determination. B. Office of Special Investigation (OSI) makes that determination. C. Wing information office makes that determination. D. By competing a risk assessment.
The answer is "By completely a risk assessment". Volume 2 section 230 under Risk Assessment reads: "Use the risk assessment to determine whether installation of an IDS is warranted or whether other supplemental controls are sufficient."