Study. uk . com
  1. Home
  2. All questions
  3. Question 16

CISM study material · question 16 of 1000

In the CSF risk communication model, which description correctly matches each layer to what it contributes?

  1. Executives set expectations on appetite and resources; managers translate them into common controls; practitioners report indicators upward
  2. Executives select the control baseline; managers audit compliance against it; practitioners write the policy that records what the auditors expect to see
  3. Executives report performance indicators upward; managers set the organisation's risk appetite; practitioners allocate the budget that funds the controls that were chosen
  4. Executives and practitioners communicate directly, bypassing managers
Show the answer

Answer: A. Executives set expectations on appetite and resources; managers translate them into common controls; practitioners report indicators upward

CSF describes bidirectional flow: executives communicate expectations on risk appetite, accountability and resources; managers pursue targets through common controls and services; practitioners supply performance and risk indicators upward.

Source: NIST CSWP 29 (NIST) — Sec. 5.1 Improving Risk Management Communication

Challenge yourself on this topic → Study as cards