Study. uk . com
  1. Home
  2. All questions
  3. Question 123

CISM study material · question 123 of 1000

An organisation with a hybrid governance structure asks how many risk assessment methodologies it should use. What does SP 800-39 suggest is appropriate?

  1. One methodology for each system, chosen by that system's own owner to suit the technology the system runs on and the staff it can call upon
  2. No fixed methodology, with each assessment improvised by the assessor from whatever evidence happens to be in front of them
  3. Several methodologies at the process tier, with an additional top-tier methodology that harmonises their findings
  4. Exactly one methodology, since a hybrid structure needs uniformity more than a centralised one to keep its results comparable
Show the answer

Answer: C. Several methodologies at the process tier, with an additional top-tier methodology that harmonises their findings

SP 800-39 suggests organisations with hybrid governance might select multiple assessment methodologies for Tier 2 and an additional Tier 1 methodology that assimilates and harmonises the findings and results of the Tier 2 assessments.

Source: NIST SP 800-39 (NIST) — Task 1-1 Risk Assumptions

Challenge yourself on this topic → Study as cards