Study. uk . com
  1. Home
  2. All questions
  3. Question 134

CISM study material · question 134 of 1000

SP 800-39 distinguishes two lighter forms of reassessment. Which pairing is correct?

  1. Incremental covers a single tier while differential covers all three tiers, so the second is always the broader of the two reviews
  2. Incremental is quantitative; differential is qualitative
  3. Incremental considers only new information; differential considers how changes affect the overall risk determination
  4. Incremental is performed by the system owner while differential is performed by the risk executive function on the owner's behalf
Show the answer

Answer: C. Incremental considers only new information; differential considers how changes affect the overall risk determination

SP 800-39 states incremental risk assessments consider only new information, such as the effect of using a new system on business risk, whereas differential assessments consider how changes affect the overall risk determination.

Source: NIST SP 800-39 (NIST) — Sec. 3.2 Assessing Risk

Challenge yourself on this topic → Study as cards