Study. uk . com
  1. Home
  2. All questions
  3. Question 138

CISM study material · question 138 of 1000

Two comparable organisations run the same assessment process, but one consistently surfaces far more threat and vulnerability information from its own staff. Which factor does SP 800-39 identify as the likely cause?

  1. A larger security budget, which buys more assessment time from staff who would otherwise be busy elsewhere
  2. A culture promoting open communication and non-retribution for sharing adverse information
  3. A more granular risk model, which subdivides threats finely enough that staff recognise the ones they have seen
  4. More frequent external audits, whose findings prompt staff to volunteer what they know before the auditor asks
Show the answer

Answer: B. A culture promoting open communication and non-retribution for sharing adverse information

SP 800-39 links culture to yield: where staff can speak openly and face no retribution for raising bad news, more threats and weaknesses surface. Budget and process do not substitute for that.

Source: NIST SP 800-39 (NIST) — Task 2-1 Threat and Vulnerability Identification

Challenge yourself on this topic → Study as cards