Study. uk . com
  1. Home
  2. All questions
  3. Question 14

CISM study material · question 14 of 1000

An assessment finds that management has approved the organisation's risk management practices, but they are not established as organisation-wide policy. Which CSF Tier does this best describe?

  1. Tier 1, Partial
  2. Tier 4, Adaptive
  3. Tier 3, Repeatable
  4. Tier 2, Risk Informed
Show the answer

Answer: D. Tier 2, Risk Informed

At Tier 2 risk practices are approved by management but not yet expressed as organisation-wide policy. Formal approval as policy is what distinguishes Tier 3, Repeatable.

Source: NIST CSWP 29 (NIST) — Appendix B CSF Tiers

Challenge yourself on this topic → Study as cards