Study. uk . com
  1. Home
  2. All questions
  3. Question 127

CISM study material · question 127 of 1000

A programme manager complains that early-phase threat analysis is less specific than the analysis done nearer deployment. How does SP 800-39 characterise this?

  1. Greater threat specificity tends to become available later in the life cycle, so the achievable level of detail depends on the phase
  2. Threat analysis should therefore be deferred until deployment, when the detail is sharp enough for the conclusions drawn from it to be relied upon
  3. Threat specificity is constant across the life cycle
  4. It indicates the early analysis was performed incorrectly
Show the answer

Answer: A. Greater threat specificity tends to become available later in the life cycle, so the achievable level of detail depends on the phase

SP 800-39 has Tier 3 roles weigh the life cycle phase when deciding how finely threats can be examined; sharper detail simply arrives later, so early analysis is coarser by nature.

Source: NIST SP 800-39 (NIST) — Task 1-1 Threat Sources

Challenge yourself on this topic → Study as cards