Study. uk . com
  1. Home
  2. All questions
  3. Question 108

CISM study material · question 108 of 1000

A security manager wants weaknesses found during assessment to actually attract funding. Which mechanism does NIST describe for connecting the two?

  1. Reclassification of weaknesses as incidents, so that the response budget rather than the investment case pays for them
  2. Direct escalation of each weakness to the board
  3. Deferring all weaknesses to the next audit cycle
  4. Corrective action and cost information from the weakness tracking plan feeding the investment case
Show the answer

Answer: D. Corrective action and cost information from the weakness tracking plan feeding the investment case

NIST describes corrective action and cost information contained in the plan of action and milestones serving as inputs to the investment case, which is how identified weaknesses reach the budget process.

Source: NIST SP 800-100 (NIST) — Sec. 5.1 Legislative Overview

Challenge yourself on this topic → Study as cards