Study. uk . com
  1. Home
  2. All questions
  3. Question 125

CISM study material · question 125 of 1000

A threat assumptions document lists the threat sources the organisation's controls are designed to address. What does SP 800-39 say it should also record?

  1. Which threat sources the safeguards and countermeasures deliberately do not address
  2. The names of the individuals responsible for operating each control and for reporting when it fails
  3. The vendor product selected for each countermeasure, so that the document doubles as an inventory
  4. The residual risk score for each threat source once the deployed safeguards have all been applied to it in turn
Show the answer

Answer: A. Which threat sources the safeguards and countermeasures deliberately do not address

SP 800-39 asks organisations to make explicit the types of threat sources to be addressed by safeguards and countermeasures as well as those not being addressed by them.

Source: NIST SP 800-39 (NIST) — Task 1-1 Threat Sources

Challenge yourself on this topic → Study as cards