Study. uk . com
  1. Home
  2. All questions
  3. Question 135

CISM study material · question 135 of 1000

A team must assess risk before the organisation has finished defining its risk frame. What does SP 800-39 permit and warn?

  1. The assessment is prohibited until framing completes
  2. The assessment must be performed by an external party instead, since no internal frame exists to bias it
  3. The assessment may proceed, but the quality of its results may be affected
  4. The assessment may proceed and its results carry the same weight as one performed against a settled frame
Show the answer

Answer: C. The assessment may proceed, but the quality of its results may be affected

SP 800-39 allows an assessment to go ahead with framing inputs or preconditions still outstanding, while cautioning that results produced that way may be of lower quality.

Source: NIST SP 800-39 (NIST) — Step 2 Inputs and Preconditions

Challenge yourself on this topic → Study as cards