Study. uk . com
  1. Home
  2. All questions
  3. Question 118

CISM study material · question 118 of 1000

Two divisions of the same organisation hold materially different risk tolerances, grounded in their different operating realities. What does SP 800-39 say leadership should do?

  1. Adopt the lower tolerance of the two everywhere
  2. Impose a single tolerance across both divisions immediately, so that risk accepted in one place means the same thing in the other
  3. Remove tolerance-setting from divisional leadership
  4. Understand and accept the differences, since they rest on operational and architectural considerations
Show the answer

Answer: D. Understand and accept the differences, since they rest on operational and architectural considerations

SP 800-39 treats divergent tolerances as legitimate where they rest on genuine operational or architectural differences; senior leaders are expected to grasp why they differ and to live with the difference.

Source: NIST SP 800-39 (NIST) — Sec. 3.1 Framing Risk

Challenge yourself on this topic → Study as cards