Study. uk . com
  1. Home
  2. All questions
  3. Question 114

CISM study material · question 114 of 1000

A risk register records only risks the organisation faces today. Which category does SP 800-39 say is also in scope?

  1. Historical risk from incidents already closed
  2. Risk that falls below the reporting threshold
  3. Risk borne entirely by third parties under contract
  4. Projected risk, expected to arise from threat trends, planned changes to the mission or architecture, or coming compliance obligations
Show the answer

Answer: D. Projected risk, expected to arise from threat trends, planned changes to the mission or architecture, or coming compliance obligations

SP 800-39 distinguishes current risk from projected risk — risk expected to arise in future based on threat assessment results, planned changes in missions or enterprise architecture, or aspects of legal and regulatory compliance.

Source: NIST SP 800-39 (NIST) — Sec. 3.3 Inputs and Preconditions

Challenge yourself on this topic → Study as cards