Study. uk . com
  1. Home
  2. All questions
  3. Question 131

CISM study material · question 131 of 1000

An organisation wants to reuse one division's risk assessment results in another division. Which two factors determine how far that reuse is legitimate? Choose two.

  1. How much autonomy the divisions hold relative to the parent organisation
  2. How similar the two divisions' missions and business functions are
  3. How many systems each division operates and how many of those systems the two divisions share
  4. How recently each division was audited
Show the answer

Answer: B. How similar the two divisions' missions and business functions are
A. How much autonomy the divisions hold relative to the parent organisation

SP 800-39 states the degree to which risk assessment information can be reused is shaped by the similarity of missions and business functions and by the degree of autonomy organisational entities have with respect to parent organisations.

Source: NIST SP 800-39 (NIST) — Sec. 3.2 Assessing Risk

Challenge yourself on this topic → Study as cards