Study. uk . com
  1. Home
  2. All questions
  3. Question 117

CISM study material · question 117 of 1000

An organisation has never articulated its assumptions, constraints, tolerance or trade-offs for risk. What consequence does SP 800-39 predict?

  1. The risk executive function is prohibited from operating until assumptions, constraints, tolerance and trade-offs have all been recorded
  2. Every risk defaults to being treated as high, because there is no agreed tolerance against which a lower rating could be defended at review
  3. Risk assessments cannot legally be performed
  4. Business owners form divergent views of risk, and the organisation cannot see how risk accepted by one function affects others
Show the answer

Answer: D. Business owners form divergent views of risk, and the organisation cannot see how risk accepted by one function affects others

SP 800-39 warns that without explicit risk frames, mission and business owners can have divergent perspectives on risk, impeding a common understanding of how risk accepted for one function affects others.

Source: NIST SP 800-39 (NIST) — Sec. 3.1 Framing Risk

Challenge yourself on this topic → Study as cards