Study. uk . com
  1. Home
  2. All questions
  3. Question 109

CISM study material · question 109 of 1000

A manager defines the purpose of the organisation's risk monitoring. Which two purposes does SP 800-39 name? Choose two.

  1. Selecting the initial control baseline for each system
  2. Identifying risk-impacting changes to systems and their environments
  3. Determining the ongoing effectiveness of risk response measures
  4. Establishing the organisation's risk tolerance
Show the answer

Answer: C. Determining the ongoing effectiveness of risk response measures
B. Identifying risk-impacting changes to systems and their environments

SP 800-39 states risk monitoring provides the means to verify compliance, determine the ongoing effectiveness of risk response measures, and identify risk-impacting changes to systems and environments of operation.

Source: NIST SP 800-39 (NIST) — Sec. 3.4 Monitoring Risk

Challenge yourself on this topic → Study as cards