Study. uk . com
  1. Home
  2. All questions
  3. Question 160

CISM study material · question 160 of 1000

Which two activities does SP 800-39 place at Tier 2, the mission and business process level? Choose two.

  1. Categorising individual information systems
  2. Framing organisational risk tolerance
  3. Prioritising business processes against the organisation's strategic goals
  4. Incorporating security requirements into the business processes themselves
Show the answer

Answer: C. Prioritising business processes against the organisation's strategic goals
D. Incorporating security requirements into the business processes themselves

Tier 2 activities include defining and prioritising business processes, defining the information they need and its sensitivity, incorporating security requirements into those processes, and establishing the enterprise architecture.

Source: NIST SP 800-39 (NIST) — Sec. 2.2 Multitiered Risk Management

Challenge yourself on this topic → Study as cards