Study. uk . com
  1. Home
  2. All questions
  3. Question 124

CISM study material · question 124 of 1000

An organisation whose culture prizes divisional autonomy does not want to mandate one risk methodology. Which approach does SP 800-39 offer?

  1. Require external consultants to perform all assessments
  2. Abandon methodology requirements entirely
  3. Define requirements for the degree of rigour and the form of results, leaving methodology choice to business owners
  4. Mandate a single methodology despite the culture
Show the answer

Answer: C. Define requirements for the degree of rigour and the form of results, leaving methodology choice to business owners

SP 800-39 says that where autonomy and diversity are central to organisational culture, organisations could define requirements for the degree of rigour and the form of results, leaving the choice of specific methodologies to mission and business owners.

Source: NIST SP 800-39 (NIST) — Task 1-1 Risk Assumptions

Challenge yourself on this topic → Study as cards