Study. uk . com
  1. Home
  2. All questions
  3. Question 120

CISM study material · question 120 of 1000

An organisation wants to begin risk framing. What does SP 800-39 identify as the key precondition?

  1. Appointment of an external risk consultant to write the frame, so that the assumptions are set by someone without a stake in them
  2. Certification against an international management standard, which supplies the assumptions, the constraints and the tolerances that the frame needs
  3. Senior leadership commitment to an explicit risk strategy and holding business owners accountable for implementing it
  4. A completed inventory of every information asset, since the frame cannot be set until the organisation knows what it is protecting
Show the answer

Answer: C. Senior leadership commitment to an explicit risk strategy and holding business owners accountable for implementing it

SP 800-39 names one precondition above the rest: leadership must commit to an explicit risk management strategy and must hold mission and business owners answerable for putting it into practice.

Source: NIST SP 800-39 (NIST) — Step 1 Inputs and Preconditions

Challenge yourself on this topic → Study as cards