Study. uk . com
  1. Home
  2. All questions
  3. Question 111

CISM study material · question 111 of 1000

An organisation sets every monitoring activity to an annual cadence regardless of subject. Which three inputs does SP 800-39 say should shape monitoring frequency instead?

  1. Audit schedule, budget year and staff availability
  2. How often deployed controls change, critical items on the corrective action plan, and risk tolerance
  3. Board meeting dates, regulatory filing deadlines and insurance renewals, since these fix when the evidence is needed
  4. Vendor patch cycles, licence renewals and hardware warranties
Show the answer

Answer: B. How often deployed controls change, critical items on the corrective action plan, and risk tolerance

SP 800-39 ties monitoring cadence to how fast deployed controls turn over, to the pressing entries on plans of action and milestones, and to the organisation's risk tolerance — not to the calendar.

Source: NIST SP 800-39 (NIST) — Sec. 3.4 Monitoring Risk

Challenge yourself on this topic → Study as cards